[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH] Add argon2.
From: |
Leo Famulari |
Subject: |
Re: [PATCH] Add argon2. |
Date: |
Sun, 5 Jun 2016 17:39:08 -0400 |
User-agent: |
Mutt/1.6.0 (2016-04-01) |
On Sun, Jun 05, 2016 at 03:46:00PM -0500, Lukas Gradl wrote:
>
> Hello Guix,
>
> Attached is a patch to add the password hashing library Argon2. It is a
> dependency for opendht.
Thanks :)
> The source tree contains the directory "blake2". At first I thought
> this is a bundled version of blake2, but it seems that this is a
> seperate implementation. The sources bundled with Argon2 are
> significantly different from the ones at
> https://github.com/BLAKE2/BLAKE2.
> My conclusion is that this is a Blake2 implementation made by and for
> Argon2. Thus I did not unbundle it. Do you agree with this?
My understanding from reading about blake2 and argon2 (not reading the
code) is that blake2 is a cryptographic hash function [0], and that
argon2 is a key derivation function [1] that uses blake2 for hashing.
When I see bundled crypto libraries, my questions are, "What's the
difference between the bundled library and the upstream code?" and "Will
they update the bundled library in a timely fashion?"
In this case, the argon2 README.md credits the blake2 code to Samuel
Neves, who is one of the designers of blake2. So, I will look into this
a little more closely to see if he reimplemented it for argon2 or if
they copied it from somewhere else.
The patch looks good to me aside from this question.
[0]
https://blake2.net/
https://en.wikipedia.org/wiki/BLAKE_%28hash_function%29
[1]
https://en.wikipedia.org/wiki/Argon2
https://www.argon2.com/
https://password-hashing.net/submissions/specs/Argon-v3.pdf