authorgravatar for sorairolake@protonmail.chShun Sakai <sorairolake@protonmail.ch> 2024-07-08 05:18:33+09:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2024-07-07 20:18:33+00:00
log8f20e81b8816aadd8ceb1b04bd3727cc1d124464
tree046d7e93c15984922326a3640d39137dc77c1419
parentc40708a2ce4f6ed1adcc1de39fc7b4fc27db32f8
signaturebadge-check Signed by PGP key B5690EEEBB952194

std.crypto.pwhash: Add recommended parameters (#20527)

These parameters according to the OWASP cheat sheet.

3 files changed, 14 insertions(+), 0 deletions(-)

lib/std/crypto/argon2.zig+4
...@@ -91,6 +91,10 @@ pub const Params = struct {...@@ -91,6 +91,10 @@ pub const Params = struct {
91 /// Baseline parameters for offline usage using argon2id type91 /// Baseline parameters for offline usage using argon2id type
92 pub const sensitive_2id = Self.fromLimits(4, 1073741824);92 pub const sensitive_2id = Self.fromLimits(4, 1073741824);
9393
94 /// Recommended parameters for argon2id type according to the
95 /// [OWASP cheat sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html).
96 pub const owasp_2id = Self{ .t = 2, .m = 19 * 1024, .p = 1 };
97
94 /// Create parameters from ops and mem limits, where mem_limit given in bytes98 /// Create parameters from ops and mem limits, where mem_limit given in bytes
95 pub fn fromLimits(ops_limit: u32, mem_limit: usize) Self {99 pub fn fromLimits(ops_limit: u32, mem_limit: usize) Self {
96 const m = mem_limit / 1024;100 const m = mem_limit / 1024;
lib/std/crypto/bcrypt.zig+6
...@@ -408,8 +408,14 @@ pub const State = struct {...@@ -408,8 +408,14 @@ pub const State = struct {
408408
409/// bcrypt parameters409/// bcrypt parameters
410pub const Params = struct {410pub const Params = struct {
411 const Self = @This();
412
411 /// log2 of the number of rounds413 /// log2 of the number of rounds
412 rounds_log: u6,414 rounds_log: u6,
415
416 /// Minimum recommended parameters according to the
417 /// [OWASP cheat sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html).
418 pub const owasp = Self{ .rounds_log = 10 };
413};419};
414420
415/// Compute a hash of a password using 2^rounds_log rounds of the bcrypt key stretching function.421/// Compute a hash of a password using 2^rounds_log rounds of the bcrypt key stretching function.
lib/std/crypto/scrypt.zig+4
...@@ -141,6 +141,10 @@ pub const Params = struct {...@@ -141,6 +141,10 @@ pub const Params = struct {
141 /// Baseline parameters for offline usage141 /// Baseline parameters for offline usage
142 pub const sensitive = Self.fromLimits(33554432, 1073741824);142 pub const sensitive = Self.fromLimits(33554432, 1073741824);
143143
144 /// Recommended parameters according to the
145 /// [OWASP cheat sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html).
146 pub const owasp = Self{ .ln = 17, .r = 8, .p = 1 };
147
144 /// Create parameters from ops and mem limits, where mem_limit given in bytes148 /// Create parameters from ops and mem limits, where mem_limit given in bytes
145 pub fn fromLimits(ops_limit: u64, mem_limit: usize) Self {149 pub fn fromLimits(ops_limit: u64, mem_limit: usize) Self {
146 const ops = @max(32768, ops_limit);150 const ops = @max(32768, ops_limit);