Closed womblep closed 10 months ago
I've looked around and I can't see any reference to using 16 byte hashes in production - 32 is the common recommendation and I don't see a reason to try and reduce that.
I can see how ideally this would "just work", but interop with random websites isn't a goal at this time. I'm generally expecting any use case for verifying a password with this library to involve creating it with this library.
If I use https://argon2.online and leave the defaults with a random salt, the generated hash wont be verified correctly by ruby_argon2.
If I change the hash length to 32 it works correctly. I changed the other parameters and that didn't seem to make any difference, just the hash length.