argon2i

Documentation

Index

• Variables
• func Generate(password string, saltLen uint32) (string, error)
• func Validate(password string, hash string) (bool, error)
• type Params

Variables

var (
	// ErrInvalidHash is returned if the required parameters can not be obtained
	// from the hash.
	ErrInvalidHash = fmt.Errorf("argon2i: invalid hash format")

	// ErrVersionIncompatible is returned if the argon2i version generating
	// the hash does not match the version validating it.
	ErrVersionIncompatible = fmt.Errorf("argon2i: incompatible version")

	// Prefix is set to be compatible with Dovecot. Can be set to an empty string.
	Prefix = "{ARGON2I}"
)

var DefaultParams = &Params{
	Memory:      256 * 1024,
	Iterations:  4,
	Parallelism: 4,
	SaltLen:     32,
	KeyLen:      32,
}

DefaultParams provides sane default parameters for password hashing as of 2021. Depending on your environment you will need to adjust these.

Functions

func Generate

func Generate(password string, saltLen uint32) (string, error)

Generate generates a new argon2i hash with recommended values for it's complexity parameters. By default the generated hash is compatible with the Dovecot Password Scheme.

See https://doc.dovecot.org/configuration_manual/authentication/password_schemes/

It looks like this

{ARGON2I}$argon2i$v=19$m=262144,t=4,p=4$KUsgM194XAqV2bsQt+OtThf/wFHwltwHJLEnNWFjW6c$Zpwq7e1tzcIlQBTbXQgnUfiryWo91IvWZbmEQc31y/s

func Validate

func Validate(password string, hash string) (bool, error)

Validate unpacks the parameters from the hash, computes the hash of the given password with these parameters and performs a constant time comparison between both hashes.

Types

type Params

type Params struct {
	Memory      uint32
	Iterations  uint32
	Parallelism uint8
	SaltLen     uint32
	KeyLen      uint32
}

Params contains the input parameters for the argon2i algorithm. Memory and Iterations tweak the computational cost. If you have more cores available you can change the parallelism to reduce runtime without reducing cost. But note that this will change the hash.

See https://tools.ietf.org/html/draft-irtf-cfrg-argon2-04#section-4