Switch to Argon2id password strategy through NSec

tera-arise / arise

A game resurrection project for the final build of TERA EU.

https://tera-arise.io

GNU Affero General Public License v3.0

27 stars 1 forks source link

Switch to Argon2id password strategy through NSec #14

Open alexrp opened 1 year ago

alexrp commented 1 year ago

https://en.wikipedia.org/wiki/Argon2
https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#argon2id

There are third-party implementations on NuGet but I don't particularly trust their correctness or performance. Would rather wait for native .NET support.

Relevant:

https://github.com/dotnet/runtime/issues/19933
https://github.com/openssl/openssl/pull/12256

alexrp commented 3 months ago

We could do this if we take a dependency on NSec which doesn't seem unreasonable. That would also render #58 unnecessary.