argon2 2.0.3 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ff5c2dcd38a21e51982265caf83a721327a8cff1a09acc5c51312ce92d2f5619
-  data.tar.gz: ab787b9e4ee2a039e286f5b96ebb65da86845749c7003de1b43061a2da2c3699
+  metadata.gz: 5e3f42d9a5dff3fd0375ce5c5106e91e0ff8d451ea2a2f4a33c3d9f837707dbd
+  data.tar.gz: 99cd35b1d042eba0b17a84eb2a8b15a023f9220b5d635f4a523e677fb8343236
 SHA512:
-  metadata.gz: 1b47bef62063b2871cd0c6235fe38e76b892b9c4b888d0b9798ccf39a6cc7daa2f4539b6a4fa1829635e5970401a59b822bcd1d1f72bfb71b9d3c79781ecf1ae
-  data.tar.gz: 476a21e271c981101b51cd0fe32ce6182635994273895de8f57c26224f9f4e4fd883a1a40139fa95c9672a2cb8dea920bce9e362e01fc0893cacfd3b28ce9625
+  metadata.gz: c1327ce0e44b87f4a16000a9d390c658343ee29f4016709e9c80a9e21e194a575cf7083d50b12e3754151d9765b2364e2abba8aa28e121b2b48d1905f1b2a1ad
+  data.tar.gz: 5fc47c017aa6e9af263760bcbb3d44cec879e38338c393562b8c3455912bf4880326a84455d0853168aa9972751bfebf7d4f2ff56c1c2f67a454c4ee63e7719c

data/.github/workflows/ruby.yml

@@ -1,32 +1,70 @@
 name: Test Suite
 
-on: push
+# Run against all commits and pull requests.
+on: [ push, pull_request ]
 
 jobs:
-  test:
+  test_matrix:
 
-    runs-on: ubuntu-latest
     strategy:
+      fail-fast: false
       matrix:
-        ruby-version: ['3.0', 2.7, 2.5]
+        os:
+          - ubuntu
+          - macos
+        ruby:
+          - 2.6
+          - 2.7
+          - 3.0
+          - head
+
+    runs-on: ${{ matrix.os }}-latest
+
+    env:
+      TEST_CHECKS: 100
+
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+      - name: Build Argon2 C library
+        run: bin/setup
+      - name: Test Argon2 C library
+        run: bin/test
+      - name: Run tests
+        run: bundle exec rake test
+      - name: Coveralls Parallel
+        uses: coverallsapp/github-action@master
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          flag-name: run-${{ matrix.ruby-version }}
+          parallel: true
+
+  rubocop:
+
+    runs-on: ubuntu-latest
 
     steps:
     - uses: actions/checkout@v2
-    - name: Set up Ruby ${{ matrix.ruby-version }}
+    - name: Set up Ruby
       uses: ruby/setup-ruby@v1
       with:
-        ruby-version: ${{ matrix.ruby-version }} 
-    - name: Install dependencies
-      run: bundle install
-    - name: Init submodules
-      run: git submodule update --init --recursive
-    - name: Build C library
-      run: bin/setup
-    - name: Test C library
-      run: cd ext/argon2_wrap/ && make test && cd ../..
-    - name: Run tests
-      run: bundle exec rake
-    - name: Coveralls
-      uses: coverallsapp/github-action@master
-      with:
-        github-token: ${{ secrets.GITHUB_TOKEN }}
+        ruby-version: 3.0
+        bundler-cache: true
+    - name: Run rubocop
+      run: bundle exec rake rubocop
+
+  finish:
+    runs-on: ubuntu-latest
+    needs: [ test_matrix, rubocop ]
+    steps:
+      - name: Coveralls Finished
+        uses: coverallsapp/github-action@master
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          parallel-finished: true
+      - name: Wait for status checks
+        run: echo "All Green!"

data/.rubocop.yml

@@ -7,6 +7,11 @@ Metrics/CyclomaticComplexity:
 Metrics/PerceivedComplexity:
   Enabled: false
 
+Metrics/ParameterLists:
+  Max: 5
+  Exclude:
+    - 'lib/argon2/ffi_engine.rb'
+
 Layout/LineLength:
   Max: 160
   Exclude:
@@ -205,4 +210,27 @@ Style/RedundantArgument: # (new in 1.4)
   Enabled: true
 Style/SwapValues: # (new in 1.1)
   Enabled: true
-
+Gemspec/DateAssignment: # (new in 1.10)
+  Enabled: true
+Lint/DeprecatedConstants: # (new in 1.8)
+  Enabled: true
+Lint/LambdaWithoutLiteralBlock: # (new in 1.8)
+  Enabled: true
+Lint/NumberedParameterAssignment: # (new in 1.9)
+  Enabled: true
+Lint/OrAssignmentToConstant: # (new in 1.9)
+  Enabled: true
+Lint/RedundantDirGlobSort: # (new in 1.8)
+  Enabled: true
+Lint/SymbolConversion: # (new in 1.9)
+  Enabled: true
+Lint/TripleQuotes: # (new in 1.9)
+  Enabled: true
+Style/EndlessMethod: # (new in 1.8)
+  Enabled: true
+Style/HashConversion: # (new in 1.10)
+  Enabled: true
+Style/IfWithBooleanLiteralBranches: # (new in 1.9)
+  Enabled: true
+Style/StringChars: # (new in 1.12)
+  Enabled: true

data/Changelog.md

@@ -1,3 +1,7 @@
+## v2.1.0: 2021-04-09
+- Introduce RBS types
+- Expose p parameter
+
 ## v2.0.3: 2021-01-02
 - Address potential memory leak. Unlikely to be exploitable.
 

data/README.md

@@ -17,7 +17,6 @@ This project has several key tenets to its design:
 * Errors from the C interface are raised as Exceptions. There are a lot of exception classes, but they tend to relate to things like very broken input, and code bugs. Calls to this library should generally not require a rescue.
 * Test suites should aim for 100% code coverage.
 * Default work values should not be considered constants. I will increase them from time to time.
-* Not exposing the threads parameter is a design choice. I believe there is significant risk, and minimal gain in using a value other than '1'. Four threads on a four core box completely ties up the entire server to process one user logon. If you want more security, increase m_cost.
 * Many Rubocop errors have been disabled, but any commit should avoid new alerts or demonstrate their necessity.
 
 ## Usage
@@ -31,7 +30,7 @@ require 'argon2'
 To generate a hash using specific time and memory cost:
 
 ```ruby
-hasher = Argon2::Password.new(t_cost: 2, m_cost: 16)
+hasher = Argon2::Password.new(t_cost: 2, m_cost: 16, p_cost: 1)
 hasher.create("password")
     => "$argon2i$v=19$m=65536,t=2,p=1$jL7lLEAjDN+pY2cG1N8D2g$iwj1ueduCvm6B9YVjBSnAHu+6mKzqGmDW745ALR38Uo"
 ```
@@ -43,7 +42,6 @@ hasher = Argon2::Password.new
 hasher.create("password")
 ```
 
-If you follow this pattern, it is important to create a new `Argon2::Password` every time you generate a hash, in order to ensure a unique salt. See [issue 23](https://github.com/technion/ruby-argon2/issues/23) for more information.
 Alternatively, use this shortcut:
 
 ```ruby
@@ -72,6 +70,17 @@ argon = Argon2::Password.new(t_cost: 2, m_cost: 16, secret: KEY)
 myhash = argon.create("A password")
 Argon2::Password.verify_password("A password", myhash, KEY)
 ```
+## Ruby 3 Types
+I am now shipping signatures in sig/. The following command sets up a testing interface.
+```sh
+RBS_TEST_TARGET="Argon2::*" bundle exec ruby -r rbs/test/setup bin/console
+```
+You should also be able to pass Steep checks:
+```sh
+steep check
+```
+These tools will need to be installed manually at this time and will be added to Gemfiles after much further testing.
+
 ## Version 2.0 - Argon 2id
 Version 2.x upwards will now default to the Argon2id hash format. This is consistent with current recommendations regarding Argon2 usage. It remains capable of verifying existing hashes.
 
@@ -80,7 +89,7 @@ Version 1.0.0 included a major version bump over 0.1.4 due to several breaking c
 
 The second of these is that the reference Argon2 implementation introduced an algorithm change, which produces a hash which is not backwards compatible. This is documented on [this PR on the C library](https://github.com/P-H-C/phc-winner-argon2/pull/115). This was a regrettable requirement to address a security concern in the algorithm itself. The two versions of the Argon2 algorithm are numbered 1.0 and 1.3 respectively.
 
-Shortly after this, version 1.0.0 of this gem was released with this breaking change, supporting only Argon2 v1.3. Further time later, the official encoding format was updated, with a spec that included the version number, and the library introduced backward compatibility. This should remove the likelihood of such breaking changes in future. Version 1.1.0 will silently introduce the current version number in hashes, in order to avoid a further compatibility break.
+Shortly after this, version 1.0.0 of this gem was released with this breaking change, supporting only Argon2 v1.3. Further time later, the official encoding format was updated, with a spec that included the version number, and the library introduced backward compatibility. This should remove the likelihood of such breaking changes in future. 
 
 
 ## Platform Issues
@@ -123,17 +132,19 @@ Any form of contribution is appreciated, however, please review [CONTRIBUTING.md
 
 ## Building locally/Tests
 
-To build the gem locally, you will need to checkout the submodule and build it manually:
+To build the gem locally, you will need to run the setup script:
+
+```shell
+./bin/setup
+```
+
+You can test that the Argon2 C library was properly imported by running the C test suite:
 
 ```shell
-git submodule update --init --recursive
-bundle install
-cd ext/argon2_wrap/
-make
-cd ../..
+./bin/test
 ```
 
-The test harness includes a property based test. To more strenuously perform this test, you can tune the iterations parameter:
+The ruby wrapper test suite includes a property based test. To more strenuously perform this test, you can tune the iterations parameter:
 
 ```shell
 TEST_CHECKS=10000 bundle exec rake test

data/Steepfile

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+target :lib do
+  signature "sig"
+
+  check "argon2.rb"
+  check "lib"                       # Directory name
+  ignore "lib/argon2/ffi_engine.rb"
+  ignore "lib/argon2/errors.rb"
+end
+
+target :spec do
+  signature "sig", "sig-private"
+
+  check "spec"
+end

data/argon2.gemspec

@@ -11,6 +11,8 @@ Gem::Specification.new do |spec|
   spec.authors       = ["Technion"]
   spec.email         = ["technion@lolware.net"]
 
+  spec.required_ruby_version = '>= 2.6.0'
+
   spec.summary       = 'Argon2 Password hashing binding'
   spec.description   = 'Argon2 FFI binding'
   spec.homepage      = 'https://github.com/technion/ruby-argon2'
@@ -31,5 +33,6 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "rubocop", '~> 1.7'
   spec.add_development_dependency "simplecov", '~> 0.20'
   spec.add_development_dependency "simplecov-lcov", '~> 0.8'
+  spec.add_development_dependency "steep", "~> 0.43.1"
   spec.extensions << 'ext/argon2_wrap/extconf.rb'
 end

data/bin/console

@@ -1,15 +1,15 @@
 #!/usr/bin/env ruby
 # frozen_string_literal: true
 
-require "bundler/setup"
-require "argon2"
+require 'bundler/setup'
+require 'argon2'
 
 # You can add fixtures and/or initialization code here to make experimenting
 # with your gem easier. You can also use a different console, if you like.
 
 # (If you use this, don't forget to add pry to your Gemfile!)
-# require "pry"
+# require 'pry'
 # Pry.start
 
-require "irb"
+require 'irb'
 IRB.start

data/bin/setup

@@ -1,10 +1,14 @@
 #!/bin/bash
+# Exit the script immediately if a command fails
 set -euo pipefail
+# Internal Field Separator
 IFS=$'\n\t'
 
+# Initialize Git Submodules
+git submodule update --init --recursive
+
+# Build the Argon2 C Library. Git submodules must be initialized first!
 bundle install
 cd ext/argon2_wrap/
 make
 cd ../..
-
-# Do any other automated setup that you need to do here

data/bin/test

@@ -0,0 +1,10 @@
+#!/bin/bash
+# Exit the script immediately if a command fails
+set -euo pipefail
+# Internal Field Separator
+IFS=$'\n\t'
+
+# Run the Argon2 C Library tests
+cd ext/argon2_wrap/
+make test
+cd ../..

data/lib/argon2/ffi_engine.rb

@@ -62,13 +62,13 @@ module Argon2
       result.unpack('H*').join
     end
 
-    def self.hash_argon2id(password, salt, t_cost, m_cost, out_len = nil)
+    def self.hash_argon2id(password, salt, t_cost, m_cost, p_cost, out_len = nil)
       out_len = (out_len || Constants::OUT_LEN).to_i
       raise ArgonHashFail, "Invalid output length" if out_len < 1
 
       result = ''
       FFI::MemoryPointer.new(:char, out_len) do |buffer|
-        ret = Ext.argon2id_hash_raw(t_cost, 1 << m_cost, 1, password,
+        ret = Ext.argon2id_hash_raw(t_cost, 1 << m_cost, p_cost, password,
                                     password.length, salt, salt.length,
                                     buffer, out_len)
         raise ArgonHashFail, ERRORS[ret.abs] unless ret.zero?
@@ -78,7 +78,7 @@ module Argon2
       result.unpack('H*').join
     end
 
-    def self.hash_argon2id_encode(password, salt, t_cost, m_cost, secret)
+    def self.hash_argon2id_encode(password, salt, t_cost, m_cost, p_cost, secret)
       result = ''
       secretlen = secret.nil? ? 0 : secret.bytesize
       passwordlen = password.nil? ? 0 : password.bytesize
@@ -87,7 +87,7 @@ module Argon2
       FFI::MemoryPointer.new(:char, Constants::ENCODE_LEN) do |buffer|
         ret = Ext.argon2_wrap(buffer, password, passwordlen,
                               salt, salt.length, t_cost, (1 << m_cost),
-                              1, secret, secretlen)
+                              p_cost, secret, secretlen)
         raise ArgonHashFail, ERRORS[ret.abs] unless ret.zero?
 
         result = buffer.read_string(Constants::ENCODE_LEN)

data/lib/argon2/hash_format.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module Argon2
+  ##
+  # Get the values from an Argon2 compatible string.
+  #
+  class HashFormat
+    attr_reader :variant, :version, :t_cost, :m_cost, :p_cost, :salt, :checksum
+
+    # FIXME: Reduce complexity/AbcSize
+    # rubocop:disable Metrics/AbcSize
+    def initialize(digest)
+      digest = digest.to_s unless digest.is_a?(String)
+
+      raise Argon2::ArgonHashFail, 'Invalid Argon2 hash' unless self.class.valid_hash?(digest)
+
+      _, variant, version, config, salt, checksum = digest.split('$')
+      # Regex magic to extract the values for each setting
+      version = /v=(\d+)/.match(version)
+      t_cost  = /t=(\d+),/.match(config)
+      m_cost  = /m=(\d+),/.match(config)
+      p_cost  = /p=(\d+)/.match(config)
+
+      # Make sure none of the values are missing
+      raise Argon2::ArgonHashFail, 'Invalid Argon2 version' if version.nil?
+      raise Argon2::ArgonHashFail, 'Invalid Argon2 time cost' if t_cost.nil?
+      raise Argon2::ArgonHashFail, 'Invalid Argon2 memory cost' if m_cost.nil?
+      raise Argon2::ArgonHashFail, 'Invalid Argon2 parallelism cost' if p_cost.nil?
+
+      @variant  = variant.to_str
+      @version  = version[1].to_i
+      @t_cost   = t_cost[1].to_i
+      @m_cost   = m_cost[1].to_i
+      @p_cost   = p_cost[1].to_i
+      @salt     = salt.to_str
+      @checksum = checksum.to_str
+    end
+    # rubocop:enable Metrics/AbcSize
+
+    ##
+    # Checks whether a given digest is a valid Argon2 hash.
+    #
+    # Supports 1 and argon2id formats.
+    #
+    def self.valid_hash?(digest)
+      /^\$argon2(id?|d).{,113}/ =~ digest
+    end
+  end
+end

data/lib/argon2/version.rb

@@ -3,5 +3,5 @@
 # Standard Gem version constant.
 
 module Argon2
-  VERSION = "2.0.3"
+  VERSION = "2.1.0"
 end

data/lib/argon2.rb

@@ -5,6 +5,7 @@ require 'argon2/ffi_engine'
 require 'argon2/version'
 require 'argon2/errors'
 require 'argon2/engine'
+require 'argon2/hash_format'
 
 module Argon2
   # Front-end API for the Argon2 module.
@@ -16,7 +17,10 @@ module Argon2
       @m_cost = options[:m_cost] || 16
       raise ArgonHashFail, "Invalid m_cost" if @m_cost < 1 || @m_cost > 31
 
-      @salt = options[:salt_do_not_supply] || Engine.saltgen
+      @p_cost = options[:p_cost] || 1
+      raise ArgonHashFail, "Invalid p_cost" if @p_cost < 1 || @p_cost > 8
+
+      @insecure_salt = options[:salt_for_testing_purposes_only]
       @secret = options[:secret]
     end
 
@@ -24,19 +28,21 @@ module Argon2
       raise ArgonHashFail, "Invalid password (expected string)" unless
         pass.is_a?(String)
 
+      # Ensure salt is freshly generated unless it was intentionally supplied.
+      salt = @insecure_salt || Engine.saltgen
+
       Argon2::Engine.hash_argon2id_encode(
-        pass, @salt, @t_cost, @m_cost, @secret)
+        pass, salt, @t_cost, @m_cost, @p_cost, @secret)
     end
 
     # Helper class, just creates defaults and calls hash()
-    def self.create(pass)
-      argon2 = Argon2::Password.new
+    def self.create(pass, options = {})
+      argon2 = Argon2::Password.new(options)
       argon2.create(pass)
     end
 
-    # Supports 1 and argon2id formats.
     def self.valid_hash?(hash)
-      /^\$argon2(id?|d).{,113}/ =~ hash
+      Argon2::HashFormat.valid_hash?(hash)
     end
 
     def self.verify_password(pass, hash, secret = nil)

data/sig/argon2.rbs

@@ -0,0 +1,16 @@
+# Classes
+module Argon2
+  class Password
+    @t_cost: Integer
+    @m_cost: Integer
+    @p_cost: Integer
+    @salt: nil | String
+    @secret: nil | String
+
+    def initialize: (?Hash[Symbol, Integer] options) -> (nil | String)
+    def create: (String pass) -> untyped
+    def self.create: (String pass) -> untyped
+    def self.valid_hash?: (string hash) -> Integer?
+    def self.verify_password: (untyped pass, untyped hash, ?nil secret) -> untyped
+  end
+end

data/sig/constants.rbs

@@ -0,0 +1,8 @@
+# Classes
+module Argon2
+  module Constants
+    SALT_LEN: Integer
+    OUT_LEN: Integer
+    ENCODE_LEN: Integer
+  end
+end

data/sig/version.rbs

@@ -0,0 +1,4 @@
+# Classes
+module Argon2
+  VERSION: String
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: argon2
 version: !ruby/object:Gem::Version
-  version: 2.0.3
+  version: 2.1.0
 platform: ruby
 authors:
 - Technion
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2021-01-02 00:00:00.000000000 Z
+date: 2021-10-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi
@@ -122,6 +122,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.8'
+- !ruby/object:Gem::Dependency
+  name: steep
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.43.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.43.1
 description: Argon2 FFI binding
 email:
 - technion@lolware.net
@@ -130,7 +144,6 @@ extensions:
 - ext/argon2_wrap/extconf.rb
 extra_rdoc_files: []
 files:
-- ".github/workflows/rubocop.yml"
 - ".github/workflows/ruby.yml"
 - ".gitignore"
 - ".gitmodules"
@@ -141,9 +154,11 @@ files:
 - LICENSE.txt
 - README.md
 - Rakefile
+- Steepfile
 - argon2.gemspec
 - bin/console
 - bin/setup
+- bin/test
 - ext/argon2_wrap/Makefile
 - ext/argon2_wrap/argon_wrap.c
 - ext/argon2_wrap/extconf.rb
@@ -233,7 +248,11 @@ files:
 - lib/argon2/engine.rb
 - lib/argon2/errors.rb
 - lib/argon2/ffi_engine.rb
+- lib/argon2/hash_format.rb
 - lib/argon2/version.rb
+- sig/argon2.rbs
+- sig/constants.rbs
+- sig/version.rbs
 homepage: https://github.com/technion/ruby-argon2
 licenses:
 - MIT
@@ -246,14 +265,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 2.6.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.2
+rubygems_version: 3.2.21
 signing_key:
 specification_version: 4
 summary: Argon2 Password hashing binding

data/.github/workflows/rubocop.yml

@@ -1,16 +0,0 @@
-name: Rubocop
-
-# Run this workflow every time a new commit pushed to your repository
-on: push
-
-jobs:
-
-  rubocop:
-    name: Rubocopchecks
-    runs-on: ubuntu-latest
-    steps:
-      - name: Run Rubocop
-        uses: gimenete/rubocop-action@1.0
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-