You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
According to the specs, = should be omitted from the b64 encoded parts of the output string. Currently, the Argon2 module includes =s in the b64 encoded parts.
>>> let salt = Salt "abcdefghijklmnop"
>>> hashPasswordWithSalt defaultParams salt (mkPassword "foobar")
PasswordHash {unPasswordHash = "$argon2id$v=19$m=65536,t=2,p=1$YWJjZGVmZ2hpamtsbW5vcA==$BztdyfEefG5V18ZNlztPrfZaU5duVFKZiI6dJeWht0o="}
In contrast, the reference implementation produces the following output string for the same input.
@jdoe0000000 Thanks for bringing this up!
I think I've either overlooked this detail or mistakenly implemented it incorrectly.
I can't remember what I used as a reference, tbh. The Argon2 specification doesn't describe the "required" format for printing a hash AFAICT. Is this format official, or just how every other library does it?
Regardless, it'd be a good idea to accept technically correct hashes.
(I was already planning on doing more with hashing formats: #11)
Do you want to make a PR for this? If not, I'll pick this up before the version 3.0.0.0 release.
tbh. The Argon2 specification doesn't describe the "required" format for printing a hash AFAICT. Is this format official, or just how every other library does it?
The specs I linked is just for the PHC string format. The specs is official AFAICT.
I guess the PHC format is technically not the official format for Argon2 since it's not in its specs, but it has a special status since it's what the reference implementation uses.
According to the specs,
=
should be omitted from theb64
encoded parts of the output string. Currently, theArgon2
module includes=
s in theb64
encoded parts.In contrast, the reference implementation produces the following output string for the same input.
Moreover,
checkPassword
will not accept hash strings without padding=
s.But the same string with padding
=
s works fine.The text was updated successfully, but these errors were encountered: