Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/crypto/argon2: argument memory should be defined like uint64 #37356

Closed
tredoe opened this issue Feb 21, 2020 · 2 comments
Closed

x/crypto/argon2: argument memory should be defined like uint64 #37356

tredoe opened this issue Feb 21, 2020 · 2 comments
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Milestone
Unreleased

Comments

@tredoe
Copy link

tredoe commented Feb 21, 2020 •
edited

The argument 'memory' at both functions 'IDKey' and 'Key' has been defined using an uint32, but it is insufficient to set a memory of at least 4GB. (https://pkg.go.dev/golang.org/x/crypto/argon2)

And like it is indicated at the RFC, it is suggested:

Backend server authentication, that takes 0.5 seconds on a
2 GHz CPU using 4 cores
-- Argon2id with 8 lanes and 4 GiB of RAM.

Key derivation for hard-drive encryption, that takes
3 seconds on a 2 GHz CPU using 2 cores
-- Argon2id with 4 lanes and 6 GiB of RAM.
@gopherbot gopherbot added this to the Unreleased milestone Feb 21, 2020
@toothrot toothrot added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Feb 21, 2020
@toothrot
Copy link
Contributor

/cc @FiloSottile

@renthraysk
Copy link

Memory parameter is in KiB not bytes.
4GiB / 1024 fits in an uint32.

"The time parameter specifies the number of passes over the memory and the memory parameter specifies the size of the memory in KiB. For example memory=64*1024 sets the memory cost to ~64 MB. The number of threads can be adjusted to the numbers of available CPUs. The cost parameters should be increased as memory latency and CPU parallelism increases. Remember to get a good random salt."
https://pkg.go.dev/golang.org/x/crypto/argon2?tab=doc

@tredoe tredoe closed this as completed Feb 21, 2020
@golang golang locked and limited conversation to collaborators Feb 20, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Projects
None yet
Milestone
Unreleased
Development

No branches or pull requests
4 participants
@toothrot @tredoe @gopherbot @renthraysk