Add OWASP recommendations as additional profiles?

technion / ruby-argon2

A Ruby gem offering bindings for Argon2 password hashing

MIT License

229 stars 30 forks source link

Add OWASP recommendations as additional profiles? #65

Closed nogweii closed 7 months ago

nogweii commented 7 months ago

As mentioned in #62 there is a lot of discussion and disagreement. I wonder if it would be valuable to make OWASP's recommended settings more easily used? I'm swayed by the arguments presented there, personally.

I'm not suggesting a change in defaults, as I'm far from qualified to make that argument.

technion commented 7 months ago

There's been multiple profiles added and I'm sure more recommendations will surface in future. Ultimately there are several reasonable profiles and I don't think constantly implementing new features to chase new work powers is ultimately a positive.

If you'd like to manually specify work powers, the process to do so is documented in the section "To generate a hash using specific time and memory cost".