#26635: "memory_cost" of Argon2PasswordHasher
-------------------------------------+-------------------------------------
Reporter: danielfeng | Owner: nobody
Type: | Status: new
Cleanup/optimization |
Component: contrib.auth | Version: master
Severity: Normal | Resolution:
Keywords: | Triage Stage:
| Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by danielfeng):
Replying to [comment:2 bwesterb]:
> This is an inconsistency in the reference C implementation itself. The
specification and the reference C implementation ''do not'' limit
themselves to power of two memory_cost's. For some unknown reason, the
commandline util which is shipped, does limit itself to power of two. In
the source code of the commandline util (src/run.c) we find
>
> {{{
> m_cost = ARGON2_MIN(UINT64_C(1) << input, UINT32_C(0xFFFFFFFF));
> }}}
>
> I see two possible solutions.
>
> The first one is to use power-of-two memory_cost's in Argon2. We should
then also rename memory_cost to memory_cost_exp to reduce confusion the
other way around. A big drawback is that we loose fine-grained control
over the running time of Argon2. Every increase in memory_cost_exp will
(at the very least) double the running time of the hash. (Recall that it
is strongly advised to increase memory_cost instead of time_cost, to
strengthen the hash.)
>
> The second solution is to ask the Argon2 developers to change their util
and add a second option -M which allows one to specify an arbitrary
memory_cost.
Thanks for the investigation. Another possible issue is that the
'''hash_len''' is currently harded-coded to use
'''argon2.DEFAULT_HASH_LENGTH''', which is '''16''' for now. I'm not sure
if such value could change / may be changed in the future, and if that
happens, would the validation fail. Haven't looked into validation logic
thus don't know if the hash value needs to be 100% match.
--
Ticket URL: <https://code.djangoproject.com/ticket/26635#comment:3>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/068.93f851f90dbfa2ebe442b37f5214fc96%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
