Expose secret / peper

[tobiasdiez]

Package version

latest

Describe the bug

Argon supports a secret key: https://github.com/P-H-C/phc-winner-argon2?tab=readme-ov-file#library

The secret parameter, which is used for keyed hashing. This allows a secret key to be input at hashing time (from some external location) and be folded into the value of the hash. This means that even if your salts and hashes are compromised, an attacker cannot brute-force to find the password without the key.

If I see this correctly then the argon2 npm package supports this (https://github.com/ranisalt/node-argon2/blob/7bf76721387db96f3ae153577dd370e08405ebe5/argon2.cjs#L57C1-L57C31) but it's not yet supported by the hash/verify methods of this package:

hash/src/drivers/argon.ts

Lines 207 to 216 in 9463702

	const hash = await driver.hash(value, {
	salt,
	version: this.#config.version,
	type: this.#variants[this.#config.variant],
	timeCost: this.#config.iterations,
	memoryCost: this.#config.memory,
	parallelism: this.#config.parallelism,
	hashLength: this.#config.hashLength,
	raw: true,
	})

Reproduction repo

No response