node-rs icon indicating copy to clipboard operation
node-rs copied to clipboard

Inconsistent documentation for argon2 default hash options

Open choutianxius opened this issue 11 months ago • 1 comments

The actual default options for argon2 hash produces

console.log(hash("123456"));
// $argon2id$v=19$m=19456,t=2,p=1$s8PyJzwJrGsbdsRzx4du5g$2lD5nmjRI3zTeUci5GJoAuVMGV9viplQuEHwG3wT14o

Indicating memoryCost = 19 * 2 ** 10, timeCost = 2, instead of what are suggested in docs:

...The default value is 4096, meaning a pool of 4 MiB per thread.

...The default value is 3.

choutianxius avatar Feb 26 '25 02:02 choutianxius

I'm also confused about this. 4MiB seems unreasonably low for Argon2 and could easily confuse people or even lead them to make insecure decisions. OWASP’s Password Storage Cheat Sheet recommends 19MiB (at least), so making that the default seems like a better idea.

kkshinkai avatar Mar 11 '25 01:03 kkshinkai