Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support Apache Shiro Argon2 hash encoding #5521

Open
solardiz opened this issue Aug 11, 2024 · 0 comments
Open

Support Apache Shiro Argon2 hash encoding #5521

solardiz opened this issue Aug 11, 2024 · 0 comments

Comments

@solardiz
Copy link
Member

https://shiro.apache.org/cryptography-features.html uses Argon2id hashes, but encodes them subtly differently. Test vectors from CMIYC 2024 cracks:

$shiro2$argon2id$v=19$t=1,m=65536,p=4$z0RJt6Ddj3RwojqdC7ldPw$GlQ2aON2k6zNEIAVUgxounobxAFbpPXh8dQkPFUvexM
$shiro2$argon2id$v=19$t=1,m=65536,p=4$2IbMDqCmh/5RI5sVZzMdUw$fwqL7fb+UY2MDL2r4QXGGExJwK05yxolYjnY1xlFje0

were after a sed crackable by our argon2-opencl like this:

$argon2id$v=19$m=65536,t=1,p=4$z0RJt6Ddj3RwojqdC7ldPw$GlQ2aON2k6zNEIAVUgxounobxAFbpPXh8dQkPFUvexM:Aditya@2011
$argon2id$v=19$m=65536,t=1,p=4$2IbMDqCmh/5RI5sVZzMdUw$fwqL7fb+UY2MDL2r4QXGGExJwK05yxolYjnY1xlFje0:Aarush@01

We could want to add a split() or prepare() to remove the $shiro2 and put m and t in the canonical order. Alternatively, for the latter we could patch upstream Argon2 code not to insist on the order, but then there would be more than one representation of the same hash in john.pot, which is undesirable.

@solardiz solardiz added this to the Potentially 2.0.0 milestone Aug 11, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant