-
Notifications
You must be signed in to change notification settings - Fork 94
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Replace pbkdf2 with argon2 via rust-argon2 #86
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I like this more than the weird build dependency. This means I finally got around to reviewing the actual crypto involved. Some issues there, it really shows how a good interface can make a crypto API more secure.
Since I rebased this off of next, do you want me to also include the actual removal of ring from cargo.toml and lib.rs? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That seems like proper usage of ad now, I was expecting something slightly different in the untangling of functional code.
Not yet. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Fixed match errors while checking
The |
2c72eb0
to
e092eef
Compare
How about now? ;) |
Separate PR, sure 👍 |
This is an alternative to #81 by using rust-argon2 instead of argonautica.
This avoids requiring clang as a dependency.
About argonautica, there's also argon2rs and rust-argon2. From what I see, argon2rs seems decent, pure rust and benchmarked. It doesn't do argon2id, only i or d variant and last commit is from 2017 and the maintainer is MIA from what I can glean from open issues.
rust-argon2 has recent commits and seems alive. Also, the talks on RustCrypto/password-hashes#1 might be of interest. They seem to come to a similar conclusion.
Related issues