Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update defaults to use second recommended option from RFC #360

Merged
merged 1 commit into from
Oct 9, 2022

Conversation

ranisalt
Copy link
Owner

@ranisalt ranisalt commented Oct 9, 2022

The published RFC has the following recommended options:

  • If a uniformly safe option that is not tailored to your
    application or hardware is acceptable, select Argon2id with t=1
    iteration, p=4 lanes, m=2^(21) (2 GiB of RAM), 128-bit salt, and
    256-bit tag size. This is the FIRST RECOMMENDED option.

  • If much less memory is available, a uniformly safe option is
    Argon2id with t=3 iterations, p=4 lanes, m=2^(16) (64 MiB of
    RAM), 128-bit salt, and 256-bit tag size. This is the SECOND
    RECOMMENDED option.

Since 2 GiB is too much for the Node engine and it will crash when allocating that much, we should adopt the second option. This will make the library safer for those that just use the defaults.

@ranisalt ranisalt merged commit b6be4ec into master Oct 9, 2022
@ranisalt ranisalt deleted the upgrade-defaults branch October 9, 2022 19:36
@gurgunday
Copy link
Contributor

Hey, thanks a lot for this update! Would you mind making a release?

@ranisalt
Copy link
Owner Author

Hey, thanks a lot for this update! Would you mind making a release?

Will do it as soon as I get back home today

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants