search

technion / ruby-argon2

A Ruby gem offering bindings for Argon2 password hashing
MIT License
229 stars 30 forks source link

Default argon2.online builds a hash which ruby_argon2 cant verify #64

Closed womblep closed 10 months ago

womblep commented 10 months ago

If I use https://argon2.online and leave the defaults with a random salt, the generated hash wont be verified correctly by ruby_argon2.

require 'argon2' => true puts Argon2::VERSION 2.3.0 => nil hash = '$argon2id$v=19$m=16,t=2,p=1$eXJ0MEtzMDlBMEpGU09MTg$T+6VYkPNTviOIOGoi8RZZA' => "$argon2id$v=19$m=16,t=2,p=1$eXJ0MEtzMDlBMEpGU09MTg$T+6VYkPNTviOIOGoi8RZZA" Argon2::Password.verify_password('password', hash) => false

image

If I change the hash length to 32 it works correctly. I changed the other parameters and that didn't seem to make any difference, just the hash length.

technion commented 10 months ago

I've looked around and I can't see any reference to using 16 byte hashes in production - 32 is the common recommendation and I don't see a reason to try and reduce that.

I can see how ideally this would "just work", but interop with random websites isn't a goal at this time. I'm generally expecting any use case for verifying a password with this library to involve creating it with this library.