#26635: "memory_cost" of Argon2PasswordHasher
-------------------------------------+-------------------------------------
Reporter: danielfeng | Owner: nobody
Type: | Status: new
Cleanup/optimization |
Component: contrib.auth | Version: master
Severity: Normal | Resolution:
Keywords: | Triage Stage:
| Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by bwesterb):
This is an inconsistency in the reference C implementation itself. The
specification and the reference C implementation ''do not'' limit
themselves to power of two memory_cost's. For some unknown reason, the
commandline util which is shipped, does limit itself to power of two. In
the source code of the commandline util (src/run.c) we find
{{{
m_cost = ARGON2_MIN(UINT64_C(1) << input, UINT32_C(0xFFFFFFFF));
}}}
I see two possible solutions.
The first one is to use power-of-two memory_cost's in Argon2. We should
then also rename memory_cost to memory_cost_exp to reduce confusion the
other way around. A big drawback is that we loose fine-grained control
over the running time of Argon2. Every increase in memory_cost_exp will
(at the very least) double the running time of the hash. (Recall that it
is strongly advised to increase memory_cost instead of time_cost, to
strengthen the hash.)
The second solution is to ask the Argon2 developers to change their util
and add a second option -M which allows one to specify an arbitrary
memory_cost.
--
Ticket URL: <https://code.djangoproject.com/ticket/26635#comment:2>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/068.26ebd01763c4eecadfb8e8397573c355%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
