search

dchest / tweetnacl-js

Port of TweetNaCl cryptographic library to JavaScript
https://tweetnacl.js.org
The Unlicense
1.77k stars 293 forks source link

Feature request - Argon2 #121

Closed paulg446 closed 7 years ago

paulg446 commented 7 years ago

Any chance of implementing Argon2 as a replacement for Scrypt? https://download.libsodium.org/libsodium/content/password_hashing/

dchest commented 7 years ago

No, TweetNaCl.js is intended to be a pure port of TweetNaCl, not a libsodium-like library; there will be no other crypto primitives in it. See also #102.

In addition to that, I wouldn't suggest using a JavaScript implementation of Argon2, since it requires 64-bit integers for good performance, which JavaScript doesn't have. Argon2 in JavaScript will be too slow compared to attacker's implementation, and thus provide more advantage to attackers. I suggest using scrypt instead (I have a fast implementation here: scrypt-async-js, which is only ~1.5-2x slower than the native one.)

paulg446 commented 7 years ago

I see. Thanks anyway for the insight regarding Argon2 - I'll stick with Scrypt (I'm already using your fantastic async implementation).