Adding RFC 9106 cost profiles?

[fnordfish]

RFC 9106 describes different default profiles depending on available memory:

If a uniformly safe option that is not tailored to your application or hardware is acceptable, select Argon2id with t=1 iteration, p=4 lanes, m=2^(21) (2 GiB of RAM), 128-bit salt, and 256-bit tag size. This is the FIRST RECOMMENDED option.

If much less memory is available, a uniformly safe option is Argon2id with t=3 iterations, p=4 lanes, m=2^(16) (64 MiB of RAM), 128-bit salt, and 256-bit tag size. This is the SECOND RECOMMENDED option.

Apart from the memory cost factors, they differ from the OWASP recommendation using p=4 lanes.

Also, for testing, it might be useful to have a pre-configured cheapest option with t=1, m=2^3, p=1

[mudge]

As there are several competing recommendations, I wanted to avoid over-specifying the various parameters (aside from picking the OWASP recommendation as a safe default that traded-off RAM usage with CPU to accommodate use in memory-constrained environments such as cheap web VMs).

What were you imagining, a new :profile argument much like Ruby Argon2's named cost profiles?

[fnordfish]

I understand, adding options to choose from invites confusion and misconfiguration.

I was imagining providing some simple constants that could splat into Argon2id::Password.create like:

Argon2id::Password.create("opensesame", **Argon2id::RFC_9106_LOW_MEM)

I think, that's whats Argon2 is doing behind the scenes as well.

Since Argin2id can be globally configured, Argon2id.rfc_9106_low_mem! would fit more than a :profile argument?

[mudge]

I like the suggestion of the constants that can be passed as keyword arguments to Argon2id::Password.create but let me think about the methods on Argon2id that update all the defaults.

I wonder if we can avoid having a “dangerous” method per profile and have a more generic method that takes each parameter as a keyword so you can call it like Argon2id.some_method_name_here(**Argon2id::RFC_9106_LOW_MEM).

[mudge]

I've raised a draft PR in #9 that provides these new parameter presets as well as a new Argon2id.set_defaults API for setting all parameters at once, e.g.

Argon2id.set_defaults(**Argon2id::RFC_9106_HIGH_MEMORY)

Please let me know what you think.

[fnordfish]

Sorry for the late reply. Looks nice!