Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Migrate password hashing functions (PBKDF2, Scrypt, etc..) to Argon2id #2519

Open
RichardFevrier opened this issue May 19, 2020 · 1 comment

Comments

@RichardFevrier
Copy link

Hello everybody 👋 thank you for your amazing work !

I was wondering now that the hashing function Argon2id is available in the official crypto module if it was not the time to migrate the current Cozy's password hashing stack ?

@nono
Copy link
Member

nono commented May 19, 2020

I don't think so. Argon2id is known as complicated to correctly tune for the environment (from OWASP) and the current password hashing function is not deprecated or with known vulnerabilities. It would take time to write a migration to Argon2id, and I really think that this time is better use for other purpose.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants