[Feature request] Allow to use a high entropy secret in pwhash

[forty]

In some situations it's nice to be able to add a high entropy secret to a password for key derivation (see for example this use case https://infosec.exchange/@sc00bz/109684199071308560)

It turns out Argon2 support this natively via the Secret (K) input. It would be nice to surface this possibility in the pwhash public API.

What do you think?

[jedisct1]

A way better approach is to encrypt the hashes.

By doing so, the secret key can be changed without requiring the plaintext password to be known and rehash everything.

The authentication tag will also protect the parameters from being changed.

[forty]

@jedisct1 I noticed that libhydrogen does as you suggest for password hashing. However for key derivation, it seems to do as I was asking https://github.com/jedisct1/libhydrogen/blob/master/impl/pwhash.h#L73 as the master_key is passed to the keyed hash rather than used for encryption in that use case.

Wouldn't it be nice to have the same option in libsodium?

[jedisct1]

This is unlikely, but you can achieve the same thing by using generichash(k=master_key, m=password) as the input of the key derivation function.

[forty]

Indeed. A benefit of using Argon2 built-in mechanism would have been, possibly, easier compatibility with other implementations (admittedly it's more of a theoretical use case for me), and to make it easier to explain what I do ("I use Argon2 with options" vs "I use Argon2+libsodium generichash"). Not a big deal anyway.

Thanks again for your availability!

[forty]

@jedisct1 Sorry to bother you, and feel free to ignore me if I'm abusing of your time. What's your opinion on

pwhash(generichash(k=master_key, m=password)) (what you suggested)

versus

generichash(k=master_key, m=pwhash(password)) (ie feed the pwhash to the kdf)

I have the feeling it's more or less the same, but I don't know if you see any reason to prefer one over the other?

[samuel-lucas6]

@forty The first is more common, but either is fine. You could also use master_key || pwhash(password) as a key with a KDF, saving a hash call.