#30472: Argon2id should be supported and become the default variety for
Argon2PasswordHasher
----------------------------------+--------------------------------------
Reporter: Si Feng | Owner: nobody
Type: New feature | Status: new
Component: Uncategorized | Version: master
Severity: Normal | Resolution:
Keywords: argon2, argon2id | Triage Stage: Unreviewed
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
----------------------------------+--------------------------------------
Description changed by Si Feng:
Old description:
> There were three important changes in the upstream
> [https://github.com/hynek/argon2_cffi argon2-cffi] library since Django
> 1.10 was released with Argon2 support:
>
> 1. (Nov 10, 2016) argon2id support was added:
> https://github.com/hynek/argon2_cffi/commit/00120a9880a74a5aedb13ee343bf6ccd507bb2d8
> #diff-1efe26b4b54ac28232eaecb9107ee6ed
> 2. (Apr 9, 2018) argon2id became its default type:
> https://github.com/hynek/argon2_cffi/pull/34/files
> 3. (Aug 18, 2018) its hasher's default memory cost changed from 512 to
> 102400, and parallelism from 2 to 8, per [https://tools.ietf.org/html
> /draft-irtf-cfrg-argon2-04#section-4 RFC draft] recommendations:
> https://github.com/hynek/argon2_cffi/commit/1ec39f8dc7a140b68099549b799301113576bde2
>
> When Django 1.10 was released, only argon2d and argon2i were available,
> hence the hard-coded argon2i variety in Argon2PasswordHasher. The
> memory_cost = 512 and parallelism = 2 were also copied from argon2-cffi
> at that time.
>
> Now we should sync Django with upstream updates.
New description:
There were three important changes in the upstream
[https://github.com/hynek/argon2_cffi argon2-cffi] library since Django
1.10 was released with Argon2 support:
1. (Nov 10, 2016) argon2id support was added:
https://github.com/hynek/argon2_cffi/commit/00120a9880a74a5aedb13ee343bf6ccd507bb2d8
#diff-1efe26b4b54ac28232eaecb9107ee6ed
2. (Apr 9, 2018) argon2id became its default type:
https://github.com/hynek/argon2_cffi/pull/34/files
3. (Aug 18, 2018) its hasher's default memory cost changed from 512 to
102400, and parallelism from 2 to 8, per [https://tools.ietf.org/html
/draft-irtf-cfrg-argon2-04#section-4 RFC draft] recommendations:
https://github.com/hynek/argon2_cffi/commit/1ec39f8dc7a140b68099549b799301113576bde2
When Django 1.10 was released, only argon2d and argon2i were available,
hence the hard-coded argon2i variety in Argon2PasswordHasher.
Though Django does not use its hasher, the memory_cost = 512 and
parallelism = 2 in Argon2PasswordHasher were simply copied from
argon2-cffi's hasher back then.
Now we should sync Django with upstream updates.
--
--
Ticket URL: <https://code.djangoproject.com/ticket/30472#comment:2>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/068.cbe86b5dddaaa64adbd4d097bef4de0d%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
