node-rs
node-rs copied to clipboard
Inconsistent documentation for argon2 default hash options
The actual default options for argon2 hash produces
console.log(hash("123456"));
// $argon2id$v=19$m=19456,t=2,p=1$s8PyJzwJrGsbdsRzx4du5g$2lD5nmjRI3zTeUci5GJoAuVMGV9viplQuEHwG3wT14o
Indicating memoryCost = 19 * 2 ** 10, timeCost = 2, instead of what are suggested in docs:
...The default value is 4096, meaning a pool of 4 MiB per thread.
...The default value is 3.
I'm also confused about this. 4MiB seems unreasonably low for Argon2 and could easily confuse people or even lead them to make insecure decisions. OWASP’s Password Storage Cheat Sheet recommends 19MiB (at least), so making that the default seems like a better idea.