Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Argon2 hash() method doesn't use provided salt, but hashRaw() does #893

Open
ainsly opened this issue Sep 19, 2024 · 0 comments
Open

Argon2 hash() method doesn't use provided salt, but hashRaw() does #893

ainsly opened this issue Sep 19, 2024 · 0 comments

Comments

@ainsly
Copy link

ainsly commented Sep 19, 2024

As the title says

The hash function uses a randomly generated salt on every invocation.

Wheres the hashRaw function takes into account the provided hash.

This doesn't effect the verify() methods since they use the encoded hash.

But the hash() method creates a totally different hex hash and encoded string each time it's invoked even if a salt is provided..

Conversely, the hashRaw() function DOES return the same correct hash, using the provided salt, each time it's invoked.

Is this by design, or simple oversight?

My thoughts were that if a salt is provided, it should use it as a parameter in Argon regardless of whether or not you're generating an encoded pw hash output or just the hex value...

Please correct me if I'm wrong and it's working as intended.

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant