Hynek weighted in[1]. I think the PR is ready to merge. Best wishes,
Bas [1] https://github.com/django/django/pull/5876#issuecomment-168411156 > On 27 Dec 2015, at 13:39, Florian Apolloner <f.apollo...@gmail.com> wrote: > > I do not see anything wrong in the PR and there is probably no reason not to > include it. It would be great if you could get feedback from dstufft and/or > hynek in #cryptography-dev -- not that we miss something. > > Cheers, > Florian > > On Sunday, December 27, 2015 at 12:36:02 AM UTC+1, Bas Westerbaan wrote: > Hello, > > This morning I submitted a Pull Request[1], which adds a PasswordHasher for > argon2 – the winner of the Password Hashing Competition.[2] Tim Graham > mentioned I should send an e-mail to this list to discuss it. > > The patch is mostly pretty straight-forward. I would like to add a few > remarks on some of the choices. > > 1. There are two Python packages that implement argon2. Both bind > libargon2[3]. The first is argon2_py[4], which uses ctypes. The second is > argon2-cffi[5], which uses... cffi. Bindings using cffi are more portable, > so I choose argon2-cffi. > > 2. argon2 has four parameters: (i) variety ("type"), (ii) time cost ("t"), > (iii) memory cost ("m") and (iv) parallelism ("p"). There are two varieties: > argon2i and argon2d. The first (argon2i) is safest against side-channel > attacks. The second tries less hard to be secure against side-channel > attacks in favour of being more resilient against GPU brute-forcing. For > web-apps, the first "argon2i" is the clear choice. For the other parameters > I choose to use the same defaults as of argon2-cffi: t=2, m=512, p=2. On a > i7-4790 @ 3.6Ghz the hash takes around 2ms to compute. > > Best wishes, > > Bas > > > > [1] https://github.com/django/django/pull/5876 > <https://github.com/django/django/pull/5876> > [2] https://password-hashing.net <https://password-hashing.net/> > [3] https://github.com/p-h-c/phc-winner-argon2 > <https://github.com/p-h-c/phc-winner-argon2> > [4] https://github.com/flamewow/argon2_py > <https://github.com/flamewow/argon2_py> > [5] https://github.com/hynek/argon2_cffi > <https://github.com/hynek/argon2_cffi> > > -- > You received this message because you are subscribed to a topic in the Google > Groups "Django developers (Contributions to Django itself)" group. > To unsubscribe from this topic, visit > https://groups.google.com/d/topic/django-developers/NTfqP4eNVyA/unsubscribe > <https://groups.google.com/d/topic/django-developers/NTfqP4eNVyA/unsubscribe>. > To unsubscribe from this group and all its topics, send an email to > django-developers+unsubscr...@googlegroups.com > <mailto:django-developers+unsubscr...@googlegroups.com>. > To post to this group, send email to django-developers@googlegroups.com > <mailto:django-developers@googlegroups.com>. > Visit this group at https://groups.google.com/group/django-developers > <https://groups.google.com/group/django-developers>. > To view this discussion on the web visit > https://groups.google.com/d/msgid/django-developers/9a3378d2-3a8b-4bd9-b1e0-d64e25475d02%40googlegroups.com > > <https://groups.google.com/d/msgid/django-developers/9a3378d2-3a8b-4bd9-b1e0-d64e25475d02%40googlegroups.com?utm_medium=email&utm_source=footer>. > For more options, visit https://groups.google.com/d/optout > <https://groups.google.com/d/optout>. -- You received this message because you are subscribed to the Google Groups "Django developers (Contributions to Django itself)" group. To unsubscribe from this group and stop receiving emails from it, send an email to django-developers+unsubscr...@googlegroups.com. To post to this group, send email to django-developers@googlegroups.com. Visit this group at https://groups.google.com/group/django-developers. To view this discussion on the web visit https://groups.google.com/d/msgid/django-developers/12EFBCDD-B66A-4B50-906C-286A3574472F%40westerbaan.name. For more options, visit https://groups.google.com/d/optout.
