Closed f3ndot closed 1 year ago
@f3ndot Thanks for this PR. I like the code changes - if you wouldn't mind dealing with the Rubocop style issues I'll be happy to merge this.
@technion awesome, glad to hear it! Only one cop was a false-positive and was inline disabled accordingly.
I will quickly say that in https://github.com/OWASP/CheatSheetSeries/issues/1183 there is some disagreement about how "good" these RFC values are. It may be worth considering https://github.com/technion/ruby-argon2/issues/63 and then adding in the OWASP values before release. Frankly the lack of consensus makes is difficult to agree one what a sane default should be.
I wonder what the most common default is for most languages's implementation of argon2. As mentioned in the description, right now this PR mirrors Python's argon2-cffi
default.
I must concede my initial apprehension was simply down to the fact everyone has their own preference for defaults, I've had several offline discussions with people and basically came to the conclusion you'll never not having someone complaining it's wrong.
This profiles approach sounds reasonable because at least you referred to RFCs. Thanks for fixing linting, I'll merge this and will cut a release shortly so people can start using this. I tried to approve it last night and had a power outage instead.
RFC 9106 is the formal standard for describing Argon2. It also gives the official recommended cost parameters that should be sufficient for all environments. This PR introduces the concept of named profiles for a set of cost parameters/values and changes the default costs to
:rfc_9106_low_memory
, the second preferred option in the RFC. The RFC's first choice can be quite computationally expensive and, mirroring Python'sargon2-cffi
, we leave that as an opt-in choice.A developer can use one of the named profiles, or continue to hand specify costs:
The list of named cost profiles are:
:rfc_9106_high_memory
: the first recommended option but is expensive:rfc_9106_low_memory
: the second recommended option (default):pre_rfc_9106
: the previous default costs forruby-argon2
<= v2.2.0, before offering RFC 9106 named profiles:unsafe_cheapest
: Strictly for testing, the minimum costs allowed by Argon2 for the fastest hashing speedA developer can see the list of profiles with
Argon2::Profiles.to_a
and the actual cost values with.to_h
or[name]
. As guidance changes over time (OWASP has its own recommended values), the list of profiles may expand or even change their values.