Req #75388 [Asn]: Argon2: Add secret/key

Edit report at https://bugs.php.net/bug.php?id=75388&edit=1 ID: 75388 Updated by: jedisct1@php.net Reported by: phpdoc at mail dot my1 dot info Summary: Argon2: Add secret/key Status: Assigned Type: Feature/Change Request Package: *Encryption and hash functions Operating System: Win8.1 x64 PHP Version: Next Minor Version Assigned To: jedisct1 Block user comment: N Private report: N New Comment: All Argon2 parameters get mixed the same way. You can add 3 extra passwords, 2 contexts and 5 more peppers with no changes to the design. The pepper was documented to improve interoperability between implementations willing to use this, but there is nothing special about the pepper/secret. The reference argon2 tool doesn't support peppers. The value of a pepper is debatable, especially since encrypting hashes is better both from an operational and a security perspective. If the pepper is leaked, you need to reset the passwords of your entire user base. The importance of encryption (including salt encryption) was pointed out and discussed by Yescrypt's author after the competition was over. libsodium does not and will not support peppers. PHP wrappers cannot expose a parameter that doesn't exist. Previous Comments: ------------------------------------------------------------------------ [2019-03-29 16:39:17] phpdoc at mail dot my1 dot info @jedisct1 but isnt that basically also just the makers of that package making their own crypto? I mean encrypting the hash shouldnt be too crazy but in the end it's just a workaround, when instead argon has a way to insert a secret. ------------------------------------------------------------------------ [2019-03-28 19:58:51] jedisct1@php.net Halite is very simple to use and does password hashing+encryption: https://github.com/paragonie/halite/blob/master/doc/Classes/Password.md ------------------------------------------------------------------------ [2019-03-28 19:50:45] davidapgilman at gmail dot com I concur with the OP - the best way to use a pepper with Argon2 is to use the built in "secret" parameter. There are workarounds as suggested, but the most elegant, audited, and cryptographically secure method is to use the built-in secret parameter as designed. I understand if there are higher priority PRs, but it's negligent and ignorant to choose to leave off a built-in security feature of the PHC winner. You're encouraging developers to roll their own encryption at worst, and forcing them to choose between a number of non-intuitive workarounds at best. I'd like to re-request this feature. ------------------------------------------------------------------------ [2018-06-16 16:22:53] phpdoc at mail dot my1 dot info @jedisct1 last time I checked, the ability of using arbitrary salts wasnt available for PASSWORD_ARGON2I and only for PASSWORD_BCRYPT and even that is deprecated. and as stange already says it is exposed by other languages and on top of it, it is a part of argon. why should one go with playing on the salt using a pseudorandom function with both a self made salt and a secret if argon can accept secrets by itself and just use that? also it's probably more secure than a self-built workaround anyway. ------------------------------------------------------------------------ [2018-03-29 15:08:56] jedisct1@php.net If you really need this, don't store the salt itself. Generate and store a random s, and use prf(k, s) as the salt. This is equivalent to adding a secret key to the initial Argon2 state. A major drawback is the fact that keys cannot be rotated. A way better approach is to encrypt the hashes. You may also want to add an authentication tag that includes the salt and parameters, to prevent resources starvation if the parameters get modified while still allowing parameter updates. Authenticated encryption is beyond the scope of a password hashing function. Combining both in a simple way is an API's responsibility. libsodium 2.x will use the libhydrogen API, but the password hashing API might be backported to the 1.x branch: https://github.com/jedisct1/libhydrogen/wiki/Password-hashing ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=75388 -- Edit this bug report at https://bugs.php.net/bug.php?id=75388&edit=1