search

technion / ruby-argon2

A Ruby gem offering bindings for Argon2 password hashing
MIT License
229 stars 30 forks source link

Allow providing parallelism cost parameter #42

Closed stouset closed 3 years ago

stouset commented 3 years ago

Right now, parallelism is hardcoded to 1. It would be great if this could be specified along with t_cost and m_cost.

technion commented 3 years ago

At the time this was written, every paper on the issue recommended p=1. I've been reluctant to let people mess with such things given the amount of _salt_do_not_provide I'm finding hardcoded in people's code. That said, I appreciate sentiment on the p value is under review, so I'll look into this. It permeates down to the C bindings so there's a bit involved.

stouset commented 3 years ago

Thanks for the response. I only noticed the README comment about parallelism being unexposed as a design decision after opening this ticket, and I can accept that there's some sharper edges around that cost parameter than might be expected.

Perhaps change the salt parameter to _salt_i_hereby_assert_under_penalty_of_international_embarrassment_that_i_am_a_qualified_cryptographer? :)

technion commented 3 years ago

Perhaps change the salt parameter to _salt_i_hereby_assert_under_penalty_of_international_embarrassment_that_i_am_a_qualified_cryptographer? :)

I can almost guarantee I'll get a PR saying "it's taking me too long to type so I've changed it"

technion commented 3 years ago

This is now pushed to master as an option.