Post #1329827
2023-02-16 22:07 UTC
@bitwarden now supports Argon2id for password hashing. The default parameters are:
m = 64 MB, t = 3, p = 4
Not all clients currently support Argon2id however, as #Bitwarden needs to wait on the various app stores to approve the app release (iOS, Android, Chrome, etc).
If you want to test how Argon2id behaves in your browser, checkout this WebAssembly tool:
https://antelle.net/argon2-browser/
Set:
- password: something NOT your password
- salt: base64(SHA-256(email))
#cryptography #passwords
Replies (1)
-
@atoponce@fosstodon.org 2023-02-16 22:10
@bitwarden@fosstodon.org The default parameters are solid defaults. Steve Thomas, one of the judges of the password hashing competition that helped pick Argon2 as the new standard, recommends these parameters as a *minimum*: - m=47104 (46 MiB), t=1, p=1 - m=19456 (19 MiB), t=2, p=1 In general, for Argon2id: - m≥93,750/(3t-1)α, t≥1, p=1 https://tobtu.com/minimum-password-settings/