Skip to content

crypto: add argon2() and argon2Sync() methods

Rodrigo Muino Tomonari requested to merge github/fork/ranisalt/crypto-argon2 into main

Argon2 is a password-based key derivation function that is designed to expensive both computationally and memory-wise in order to make force attacks unrewarding.

OpenSSL added support for the Argon2 algorithm in the 3.2.0 (see https://github.com/openssl/openssl/pull/12256). Add a js API modeled after crypto.scrypt() and crypto.scryptSync().

Related work:

  • argon2, a library currently available to support Argon2 in Node.js (disclaimer: I am the author)
  • Issue #34452 (closed) requests native support for Argon2, closed due to OpenSSL not implementing it yet

Caveats:

  • OpenSSL v3.2.0 has not yet been released, so this is preliminary work based on the latest beta release (beta1 as of opening this pull request). To test this pull request, you must have OpenSSL 3.2 or later installed. Run ./configure with the following flags: --shared-openssl --shared-openssl-libpath /usr/lib/openssl-3.2/ --shared-openssl-includes /usr/include/openssl-3.2 (adjust accordingly)
  • It was not possible to enable passing the number of threads to the OpenSSL functions, Node.js hangs if you fire more than one async job at once. For now, it will run single threaded, which affects performance but results in the same hashes, so adding support later should be transparent to the user. solved

Merge request reports