Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update default configuration for Argon2PasswordEncoder

Browse Source 
The recommended minimums for Argon2, as per OWASP Cheat Sheet Series (https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html), are:
Use Argon2id with a minimum configuration of 15 MiB of memory, an iteration count of 2, and 1 degree of parallelism.

Previous default configuration:
memory=4, iterations=3, parallelism=1

New default configuration:
memory=16, iterations=2, parallelism=1

Issue gh-10506
This commit is contained in:
Joe Grandja
2022-09-26 10:58:07 -04:00
parent 8d096554f8
commit 2ea62d0f8b
4 changed files with 66 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
crypto/src/test/java/org/springframework/security/crypto/argon2/Argon2PasswordEncoderTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2019 the original author or authors.
* Copyright 2002-2022 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -39,7 +39,7 @@ public class Argon2PasswordEncoderTests {
@Mock
private BytesKeyGenerator keyGeneratorMock;
private Argon2PasswordEncoder encoder = new Argon2PasswordEncoder();
private Argon2PasswordEncoder encoder = Argon2PasswordEncoder.defaultsForSpringSecurity_v5_2();
@Test
public void encodeDoesNotEqualPassword() {
@@ -127,6 +127,15 @@ public class Argon2PasswordEncoderTests {
"$argon2id$v=19$m=512,t=5,p=4$QUFBQUFBQUFBQUFBQUFBQQ$PNv4C3K50bz3rmON+LtFpdisD7ePieLNq+l5iUHgc1k");
}
@Test
public void encodeWhenUsingPredictableSaltWithDefaultsForSpringSecurity_v5_8ThenEqualTestHash() throws Exception {
this.encoder = Argon2PasswordEncoder.defaultsForSpringSecurity_v5_8();
injectPredictableSaltGen();
String hash = this.encoder.encode("sometestpassword");
assertThat(hash).isEqualTo(
"$argon2id$v=19$m=16384,t=2,p=1$QUFBQUFBQUFBQUFBQUFBQQ$zGt5MiNPSUOo4/7jBcJMayCPfcsLJ4c0WUxhwGDIYPw");
}
@Test
public void upgradeEncodingWhenSameEncodingThenFalse() {
String hash = this.encoder.encode("password");
@@ -135,7 +144,7 @@ public class Argon2PasswordEncoderTests {
@Test
public void upgradeEncodingWhenSameStandardParamsThenFalse() {
Argon2PasswordEncoder newEncoder = new Argon2PasswordEncoder();
Argon2PasswordEncoder newEncoder = Argon2PasswordEncoder.defaultsForSpringSecurity_v5_2();
String hash = this.encoder.encode("password");
assertThat(newEncoder.upgradeEncoding(hash)).isFalse();
}

8
crypto/src/test/java/org/springframework/security/crypto/factory/PasswordEncoderFactoriesTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2019 the original author or authors.
* Copyright 2002-2022 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -105,4 +105,10 @@ public class PasswordEncoderFactoriesTests {
assertThat(this.encoder.matches(this.rawPassword, encodedPassword)).isTrue();
}
@Test
public void matchesWhenArgon2SpringSecurity_v5_8ThenWorks() {
String encodedPassword = "{argon2@SpringSecurity_v5_8}$argon2id$v=19$m=16384,t=2,p=1$v7fN5p91BQbdbA2HfdSPRg$MULpa02CO/6FKfqwuerCFvS7OhMxGFCKUOoWfzt86Rc";
assertThat(this.encoder.matches(this.rawPassword, encodedPassword)).isTrue();
}
}