Skip to content

Commit f65956e

Browse files
sgolemonsgolemon
committed
Relax argon2 mem_cost down to 64k, bump time_cost to 4
1 parent aa0e29a commit f65956e

File tree

5 files changed

+28
-35
lines changed

5 files changed

+28
-35
lines changed

‎ext/sodium/sodium_pwhash.c

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,16 +29,15 @@
2929
#if SODIUM_LIBRARY_VERSION_MAJOR > 9 || (SODIUM_LIBRARY_VERSION_MAJOR == 9 && SODIUM_LIBRARY_VERSION_MINOR >= 6)
3030

3131
/**
32-
* OPSLIMIT and MEMLIMIT are taken from libsodium's MODERATE values.
3332
* MEMLIMIT is normalized to KB even though sodium uses Bytes in order to
3433
* present a consistent user-facing API.
3534
*
3635
* Threads are fixed at 1 by libsodium.
3736
*
3837
* When updating these values, synchronize ext/standard/php_password.h values.
3938
*/
40-
#define PHP_SODIUM_PWHASH_MEMLIMIT (256 << 10)
41-
#define PHP_SODIUM_PWHASH_OPSLIMIT 3
39+
#define PHP_SODIUM_PWHASH_MEMLIMIT (64 << 10)
40+
#define PHP_SODIUM_PWHASH_OPSLIMIT 4
4241
#define PHP_SODIUM_PWHASH_THREADS 1
4342

4443
static zend_string *php_sodium_argon2_hash(const zend_string *password, zend_array *options, int alg) {

‎ext/sodium/tests/php_password_hash_argon2i.phpt

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -36,38 +36,38 @@ foreach([1, 2, 4] as $mem) {
3636
--EXPECTF--
3737
Argon2 provider: string(%d) "%s"
3838
Using password: string(44) "%s"
39-
Hash: string(97) "$argon2i$v=19$m=262144,t=3,p=1$%s$%s"
39+
Hash: string(96) "$argon2i$v=19$m=65536,t=4,p=1$%s$%s"
4040
bool(true)
4141
bool(false)
4242
Using password: string(44) "%s"
43-
Hash: string(97) "$argon2i$v=19$m=262144,t=6,p=1$%s$%s"
43+
Hash: string(96) "$argon2i$v=19$m=65536,t=8,p=1$%s$%s"
4444
bool(true)
4545
bool(false)
4646
Using password: string(44) "%s"
47-
Hash: string(98) "$argon2i$v=19$m=262144,t=12,p=1$%s$%s"
47+
Hash: string(97) "$argon2i$v=19$m=65536,t=16,p=1$%s$%s"
4848
bool(true)
4949
bool(false)
5050
Using password: string(44) "%s"
51-
Hash: string(97) "$argon2i$v=19$m=524288,t=3,p=1$%s$%s"
51+
Hash: string(97) "$argon2i$v=19$m=131072,t=4,p=1$%s$%s"
5252
bool(true)
5353
bool(false)
5454
Using password: string(44) "%s"
55-
Hash: string(97) "$argon2i$v=19$m=524288,t=6,p=1$%s$%s"
55+
Hash: string(97) "$argon2i$v=19$m=131072,t=8,p=1$%s$%s"
5656
bool(true)
5757
bool(false)
5858
Using password: string(44) "%s"
59-
Hash: string(98) "$argon2i$v=19$m=524288,t=12,p=1$%s$%s"
59+
Hash: string(98) "$argon2i$v=19$m=131072,t=16,p=1$%s$%s"
6060
bool(true)
6161
bool(false)
6262
Using password: string(44) "%s"
63-
Hash: string(98) "$argon2i$v=19$m=1048576,t=3,p=1$%s$%s"
63+
Hash: string(97) "$argon2i$v=19$m=262144,t=4,p=1$%s$%s"
6464
bool(true)
6565
bool(false)
6666
Using password: string(44) "%s"
67-
Hash: string(98) "$argon2i$v=19$m=1048576,t=6,p=1$%s$%s"
67+
Hash: string(97) "$argon2i$v=19$m=262144,t=8,p=1$%s$%s"
6868
bool(true)
6969
bool(false)
7070
Using password: string(44) "%s"
71-
Hash: string(99) "$argon2i$v=19$m=1048576,t=12,p=1$%s$%s"
71+
Hash: string(98) "$argon2i$v=19$m=262144,t=16,p=1$%s$%s"
7272
bool(true)
7373
bool(false)

‎ext/sodium/tests/php_password_hash_argon2id.phpt

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -36,38 +36,39 @@ foreach([1, 2, 4] as $mem) {
3636
--EXPECTF--
3737
Argon2 provider: string(%d) "%s"
3838
Using password: string(44) "%s"
39-
Hash: string(98) "$argon2id$v=19$m=262144,t=3,p=1$%s$%s"
39+
Hash: string(97) "$argon2id$v=19$m=65536,t=4,p=1$%s$%s"
4040
bool(true)
4141
bool(false)
4242
Using password: string(44) "%s"
43-
Hash: string(98) "$argon2id$v=19$m=262144,t=6,p=1$%s$%s"
43+
Hash: string(97) "$argon2id$v=19$m=65536,t=8,p=1$%s$%s"
4444
bool(true)
4545
bool(false)
4646
Using password: string(44) "%s"
47-
Hash: string(99) "$argon2id$v=19$m=262144,t=12,p=1$%s$%s"
47+
Hash: string(98) "$argon2id$v=19$m=65536,t=16,p=1$%s$%s"
4848
bool(true)
4949
bool(false)
5050
Using password: string(44) "%s"
51-
Hash: string(98) "$argon2id$v=19$m=524288,t=3,p=1$%s$%s"
51+
Hash: string(98) "$argon2id$v=19$m=131072,t=4,p=1$%s$%s"
5252
bool(true)
5353
bool(false)
5454
Using password: string(44) "%s"
55-
Hash: string(98) "$argon2id$v=19$m=524288,t=6,p=1$%s$%s"
55+
Hash: string(98) "$argon2id$v=19$m=131072,t=8,p=1$%s$%s"
5656
bool(true)
5757
bool(false)
5858
Using password: string(44) "%s"
59-
Hash: string(99) "$argon2id$v=19$m=524288,t=12,p=1$%s$%s"
59+
Hash: string(99) "$argon2id$v=19$m=131072,t=16,p=1$%s$%s"
6060
bool(true)
6161
bool(false)
6262
Using password: string(44) "%s"
63-
Hash: string(99) "$argon2id$v=19$m=1048576,t=3,p=1$%s$%s"
63+
Hash: string(98) "$argon2id$v=19$m=262144,t=4,p=1$%s$%s"
6464
bool(true)
6565
bool(false)
6666
Using password: string(44) "%s"
67-
Hash: string(99) "$argon2id$v=19$m=1048576,t=6,p=1$%s$%s"
67+
Hash: string(98) "$argon2id$v=19$m=262144,t=8,p=1$%s$%s"
6868
bool(true)
6969
bool(false)
7070
Using password: string(44) "%s"
71-
Hash: string(100) "$argon2id$v=19$m=1048576,t=12,p=1$%s$%s"
71+
Hash: string(99) "$argon2id$v=19$m=262144,t=16,p=1$%s$%s"
7272
bool(true)
7373
bool(false)
74+

‎ext/standard/php_password.h

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -34,14 +34,11 @@ PHP_MSHUTDOWN_FUNCTION(password);
3434

3535
#if HAVE_ARGON2LIB
3636
/**
37-
* OPSLIMIT and MEMLIMIT are taken from libsodium's MODERATE values.
38-
* Threads are fixed at 1 by libsodium.
39-
*
4037
* When updating these values, synchronize ext/sodium/sodium_pwhash.c values.
4138
* Note that libargon expresses memlimit in KB, while libsoidum uses bytes.
4239
*/
43-
#define PHP_PASSWORD_ARGON2_MEMORY_COST (256 << 10)
44-
#define PHP_PASSWORD_ARGON2_TIME_COST 3
40+
#define PHP_PASSWORD_ARGON2_MEMORY_COST (64 << 10)
41+
#define PHP_PASSWORD_ARGON2_TIME_COST 4
4542
#define PHP_PASSWORD_ARGON2_THREADS 1
4643
#endif
4744

‎ext/standard/tests/password/password_needs_rehash_argon2.phpt

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -10,24 +10,20 @@ if (!defined('PASSWORD_ARGON2ID')) die('skip password_hash not built with Argon2
1010

1111
$hash = password_hash('test', PASSWORD_ARGON2I);
1212
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2I));
13-
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2I, ['memory_cost' => 1<<17]));
14-
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2I, ['time_cost' => 4]));
15-
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2I, ['threads' => 4]));
13+
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2I, ['memory_cost' => PASSWORD_ARGON2_DEFAULT_MEMORY_COST * 2]));
14+
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2I, ['time_cost' => PASSWORD_ARGON2_DEFAULT_TIME_COST + 1]));
1615

1716
$hash = password_hash('test', PASSWORD_ARGON2ID);
1817
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2ID));
19-
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2ID, ['memory_cost' => 1<<17]));
20-
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2ID, ['time_cost' => 4]));
21-
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2ID, ['threads' => 4]));
18+
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2ID, ['memory_cost' => PASSWORD_ARGON2_DEFAULT_MEMORY_COST * 2]));
19+
var_dump(password_needs_rehash($hash, PASSWORD_ARGON2ID, ['time_cost' => PASSWORD_ARGON2_DEFAULT_TIME_COST + 1]));
20+
2221
echo "OK!";
23-
?>
2422
--EXPECT--
2523
bool(false)
2624
bool(true)
2725
bool(true)
28-
bool(true)
2926
bool(false)
3027
bool(true)
3128
bool(true)
32-
bool(true)
3329
OK!

0 commit comments

Comments
 (0)