4 ms·

I'm amazed that the reference implementation of Argon2 had a bug. So that means anyone who deployed Argon2 today didn't really use Argon2 (I'm being pedantic),

by ktta 9y ago

I'm amazed that the reference implementation of Argon2 had a bug. So that means anyone who deployed Argon2 today didn't really use Argon2 (I'm being pedantic), but something else? libsodium also got it wrong, so that brought down my opinion of it being a trusted and well-reviewed library. Now the question is, will they continue to use the same implementation or move to the fixed code?

loup-vaillant 9y ago
Maybe the authors will fix the code in subsequent versions of Argon2. Right now, backward compatibility is deemed more important. The effects of this bug are practically negligible anyway. I bet a single bit of additional entropy in a password would compensate that a hundred fold. I'm a bit disappointed however at their not updating the specs. I signalled the bug in January, and the latest version of the appear to have been published in March. I guess they had other priorities. Don't be too hard on Libsodium: they only got it wrong because they reused the reference implementation. (Also, I don't see them breaking backward compatibility either.)
- ktta 9y ago
  I'm also referring to the orgs who used Argon2 in production. If they move to the fixed version of Argon2 in libsodium, they'll have to make a plan to securely move to the correct implementation by hashing the passwords again. It can be done, but I'm wondering if they'll even bother.
  - user5994461 9y ago
    There is hardly anyone using Argon in production. The few hipsters who jumped on the new hashing algorithm bandwagon can't have much users.
mrb 9y ago
Those who deployed Argon2 must have deployed the reference implementation, therefore the code became the de facto standard. Khovratovich confirmed in https://github.com/P-H-C/phc-winner-argon2/issues/183#issuecomment-270814216 https://github.com/P-H-C/phc-winner-argon2/issues/183#issuec... that the code is the de facto standard and the spec will be edited to reflect this. libsodium implemented the same behavior simply because it reused the Argon2 reference implementation.

by ktta 9y ago

loup-vaillant 9y ago

Maybe the authors will fix the code in subsequent versions of Argon2. Right now, backward compatibility is deemed more important. The effects of this bug are practically negligible anyway. I bet a single bit of additional entropy in a password would compensate that a hundred fold. I'm a bit disappointed however at their not updating the specs. I signalled the bug in January, and the latest version of the appear to have been published in March. I guess they had other priorities. Don't be too hard on Libsodium: they only got it wrong because they reused the reference implementation. (Also, I don't see them breaking backward compatibility either.)

ktta 9y ago
I'm also referring to the orgs who used Argon2 in production. If they move to the fixed version of Argon2 in libsodium, they'll have to make a plan to securely move to the correct implementation by hashing the passwords again. It can be done, but I'm wondering if they'll even bother.
- user5994461 9y ago
  There is hardly anyone using Argon in production. The few hipsters who jumped on the new hashing algorithm bandwagon can't have much users.

mrb 9y ago

Those who deployed Argon2 must have deployed the reference implementation, therefore the code became the de facto standard. Khovratovich confirmed in https://github.com/P-H-C/phc-winner-argon2/issues/183#issuecomment-270814216 https://github.com/P-H-C/phc-winner-argon2/issues/183#issuec... that the code is the de facto standard and the spec will be edited to reflect this. libsodium implemented the same behavior simply because it reused the Argon2 reference implementation.