Re: State of Argon2 support

[Daniel Kiper]

On Thu, Jan 04, 2024 at 10:49:06AM -0500, Nikolaos Chatzikonstantinou wrote:
> On Mon, Jan 1, 2024 at 2:48 PM Patrick Steinhardt <ps@pks.im> wrote:
> > On Fri, Dec 22, 2023 at 09:43:35PM -0600, Oskari Pirhonen wrote:
> > > On Fri, Dec 22, 2023 at 12:29:22 -0500, Nikolaos Chatzikonstantinou wrote:
> > > > 2. libgcrypt does not have support for Argon2. Possible solution is to
> > > > use the reference implementation, licensed under CC0. This is bringing
> > > > up issues (that I don't fully understand), would be preferable if the
> > > > authors released under GPLv3. Has there been a follow-up on this?
> > > > <https://lists.gnu.org/archive/html/grub-devel/2020-03/msg00170.html>
> > > >
> > >
> > > Libgcrypt supports Argon2 as of 1.10 (March 2022). The version of
> > > libgcrypt that is bundled with GRUB is older than that.
> >
> > Indeed. There are two different ways to implement Argon2 support in
> > GRUB:
> >
> >   - Use the reference implementation of Argon2.
> >
> >   - Update libgcrypt to a newer version.
> >
> > Problem is that upgrading the bundled libgcrypt library is not trivial
> > at all. I've tried multiple times, and every single time I quickly gave
> > up. There's simply too many things that have changed, and GRUB does have
> > quite a lot of patches on top of the current bundled version of the
> > library. Regardless of that it would be the right thing to do, because
> > in the long run we do want an up-to-date version of libgrcypt regardless
> > of Argon2 support anyway.
>
> That is interesting! Maybe I can give it a try.
>
> It seems to me that my game plan is to find the two versions of
> libgcrypt (old and new) and read the NEWS file carefully for how to
> migrate.

If you manage to do that it would be perfect...

If you have any questions or need help drop me a line.

Daniel