Closed f3ndot closed 1 year ago
Thanks for this report!
I believe the original intention was to use "minimums" that basically ensured the C library was being passed something sane enough that we didn't get a UB, and letting the exception you've shown be the exception the C library raised for you. Now that a recent commit exposed these values, they should be better. I'm pushing an increase now.
Looking at the source code for v2.2.0 and even master's not-yet-released
MIN_M_COST
constant, the library checks that an initialization kwargm_cost
value isn't less than 1:https://github.com/technion/ruby-argon2/blob/3282118946d4aba1ba5138fc11f36833edea5692/lib/argon2.rb#L19
https://github.com/technion/ruby-argon2/blob/3282118946d4aba1ba5138fc11f36833edea5692/lib/argon2.rb#L28-L29
The minimum value should be 3, not 1-- At least for a Debian 12 docker image (Windows 10 host):
Now I will concede that argon2's minimum memory values is dependent on certain factors around the machine running it. For portability I understand that it may be best to let the ffi'd argon2 engine be responsible for the errors and validation.
That being said, if you were to release the current state of master the following would raise an exception which would violate many author's/developer's assumptions:
If possible, the ruby constants should map to or extract from the C constants
ARGON2_MIN_MEMORY
and its friends inargon2.h
: https://github.com/P-H-C/phc-winner-argon2/blob/f57e61e19229e23c4445b85494dbf7c07de721cb/include/argon2.h#L46-L88