Password verification fails if hash is not of the default length (32 bytes)

[andreimilto]

If parameter hashLength has a value different from the default one (32) when a password hash is computed, then subsequent verification of the password using this hash fails, e.g.:

string password = "password";
string hash = Argon2.Hash(password, hashLength: 16);
bool isPasswordValid = Argon2.Verify(hash, password);

Here isPasswordValid contains the value false.

The only workaround is to use an overload of Verify with config parameter that allows specifying the length of the hash manually:

string password = "password";
string hash = Argon2.Hash(password, hashLength: 16);

var config = new Argon2Config
{
    HashLength = 16,
    Password = Encoding.UTF8.GetBytes(password)
};
var isPasswordValid = Argon2.Verify(hash, config);`

Here isPasswordValid is set to true. This workaround is not always easy to use. For instance, it may be problematic to specify the hash length manually, if the hash is fetched from a DB column in which hashes of different lengths are stored.

All in all, the described behavior looks like a bug to me. I think a user expects any overload of Verify method (even the one that allows specifying the hash length manually through the config parameter) to determine the hash length automatically from the supplied modular hash-string, e.g.:

1. Supplied hash-string: $argon2id$v=19$m=65536,t=3,p=1$i7b+qK1wdFdRO4+d6d+EIQ$lftJwq/kAzpF2mUYlZ7/6Q.
2. Base64-encoded hash: lftJwq/kAzpF2mUYlZ7/6Q.
3. Hash length: 16.

[v-c0de]

I also have the same issue. It is not an issue with the hash that is generated, because I was able to verify it using an online Argon2 hash generator & verifier

I agree with @MiltoA that is is a bug. The overload for Verify should automatically determine the hash length based on the encoded hash.

[mheyman]

Good catch. One line oversight fixed (plus 3 line unit test ). Fixed in version 1.1.5 available on nuget.org