argon2id 0.1.2-x86-linux → 0.2.0-x86-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e1f63546707d0e46aee9885bdefe53e2ad60fe73e09bbe39edf49a2b51c18b36
-  data.tar.gz: 5c41079e11b83b3383fe01af5ce6d2e9e92db960062b75250c27b45b8f657ae1
+  metadata.gz: 856f05288f1c391b7a2e0fa02106ae7ecff332a75c882234ba1521c060e35baf
+  data.tar.gz: 3f7761affd039e53dd979ab1064e25598773a5b5723e7dec1d0c8b5a890e3c92
 SHA512:
-  metadata.gz: e96bca7cadf7b08f3c02ea4b623732fd6d25cca5cedc8793ca272d40339b904ae18ca67bfc12c505dead8a1488d8687d5218063750267164907f45490f53201c
-  data.tar.gz: d4585b583d27e9043545068a1683771dcb54b2d2f1b95afc5859c4930170dfc93002dd82d76bfdcf0728ac21ff7fab4467696ead4d3c0584388b8e0e91cf2b7d
+  metadata.gz: 2afcc7f9524863a2df47a11a15756ea998f8b405fad1b3616cb379dfa90cb194961c938a5c7b8e29cdd23edc90e8633acde091746735992474b794a12cf59191
+  data.tar.gz: 640526ac7b13260f9303bacebf9995f9dc7240d3852053973f035ae9096e5449f24d0cd41509592b36fa770f9994a63195c2941a2a4c45b156ee8f216fe4ceb5

data/CHANGELOG.md

@@ -7,10 +7,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [0.1.2] - 2024-11-01
 
+### Added
+
+- The original salt for an `Argon2id::Password` can now be retrieved with
+  `Argon2id::Password#salt`
+
+### Changed
+
+- Encoded hashes are now validated when initialising an `Argon2id::Password`,
+  raising an `ArgumentError` if they are invalid
+
+## [0.1.2] - 2024-11-01
+
 ### Fixed
 
-- Validate that the encoded hash passed to Argon2id::Password.new is a
-  null-terminated C string, raising an ArgumentError if it contains extra null
+- Validate that the encoded hash passed to `Argon2id::Password.new` is a
+  null-terminated C string, raising an `ArgumentError` if it contains extra null
   bytes
 
 ## [0.1.1] - 2024-11-01
@@ -32,6 +44,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   reference C implementation of Argon2, the password-hashing function that won
   the Password Hashing Competition.
 
+[0.2.0]: https://github.com/mudge/argon2id/releases/tag/v0.2.0
 [0.1.2]: https://github.com/mudge/argon2id/releases/tag/v0.1.2
 [0.1.1]: https://github.com/mudge/argon2id/releases/tag/v0.1.1
 [0.1.0]: https://github.com/mudge/argon2id/releases/tag/v0.1.0

data/README.md

@@ -5,17 +5,17 @@ function that won the 2015 [Password Hashing Competition][].
 
 [![Build Status](https://github.com/mudge/argon2id/actions/workflows/tests.yml/badge.svg?branch=main)](https://github.com/mudge/argon2id/actions)
 
-**Current version:** 0.1.2  
+**Current version:** 0.2.0  
 **Bundled Argon2 version:** libargon2.1 (20190702)
 
 ```ruby
-Argon2::Password.create("opensesame").to_s
+Argon2id::Password.create("opensesame").to_s
 #=> "$argon2id$v=19$m=19456,t=2,p=1$ZS2nBFWBpnt28HjtzNOW4w$SQ+p+dIcWbpzWpZQ/ZZFj8IQkyhYZf127U4QdkRmKFU"
 
-Argon2::Password.create("opensesame") == "opensesame"
+Argon2id::Password.create("opensesame") == "opensesame"
 #=> true
 
-Argon2::Password.new("$argon2id$v=19$m=19456,t=2,p=1$ZS2nBFWBpnt28HjtzNOW4w$SQ+p+dIcWbpzWpZQ/ZZFj8IQkyhYZf127U4QdkRmKFU") == "opensesame"
+Argon2id::Password.new("$argon2id$v=19$m=19456,t=2,p=1$ZS2nBFWBpnt28HjtzNOW4w$SQ+p+dIcWbpzWpZQ/ZZFj8IQkyhYZf127U4QdkRmKFU") == "opensesame"
 #=> true
 ```
 
@@ -142,6 +142,14 @@ password.is_password?("opensesame")    #=> true
 password.is_password?("notopensesame") #=> false
 ```
 
+The original salt for a password can be retrieved with `Argon2id::Password#salt`:
+
+```ruby
+password = Argon2id::Password.new("$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4")
+password.salt
+#=> "somesalt"
+```
+
 ### Errors
 
 Any errors returned from Argon2 will be raised as `Argon2id::Error`, e.g.

data/argon2id.gemspec

@@ -53,6 +53,7 @@ Gem::Specification.new do |s|
   ]
   s.rdoc_options = ["--main", "README.md"]
 
+  s.add_runtime_dependency("base64")
   s.add_development_dependency("rake-compiler", "~> 1.2")
   s.add_development_dependency("rake-compiler-dock", "~> 1.5")
   s.add_development_dependency("minitest", "~> 5.25")

data/lib/argon2id/password.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "base64"
 require "openssl"
 
 module Argon2id
@@ -17,9 +18,28 @@ module Argon2id
   #   password == "password"
   #   #=> true
   class Password
+    # A regular expression to match valid hashes.
+    PATTERN = %r{
+      \A
+      \$
+      argon2(?:id|i|d)
+      (?:\$v=\d+)?
+      \$m=\d+
+      ,t=\d+
+      ,p=\d+
+      \$
+      (?<base64_salt>[a-zA-Z0-9+/]+)
+      \$
+      [a-zA-Z0-9+/]+
+      \z
+    }x.freeze
+
     # The encoded password hash.
     attr_reader :encoded
 
+    # The salt.
+    attr_reader :salt
+
     # Create a new Password object that hashes a given plain text password +pwd+.
     #
     # - +:t_cost+: integer (default 2) the "time cost" given as a number of iterations
@@ -57,8 +77,13 @@ module Argon2id
     # Create a new Password with the given encoded password hash.
     #
     #   password = Argon2id::Password.new("$argon2id$v=19$m=19456,t=2,p=1$FI8yp1gXbthJCskBlpKPoQ$nOfCCpS2r+I8GRN71cZND4cskn7YKBNzuHUEO3YpY2s")
+    #
+    # Raises an ArgumentError if given an invalid hash.
     def initialize(encoded)
+      raise ArgumentError, "invalid hash" unless PATTERN =~ encoded
+
       @encoded = encoded
+      @salt = Base64.decode64(Regexp.last_match(:base64_salt))
     end
 
     # Return the encoded password hash.

data/lib/argon2id/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Argon2id
-  VERSION = "0.1.2"
+  VERSION = "0.2.0"
 end

data/lib/argon2id.rb

@@ -15,7 +15,7 @@ module Argon2id
   DEFAULT_T_COST = 2
 
   # The default "memory cost" of 19 mebibytes recommended by OWASP.
-  DEFAULT_M_COST = 19456
+  DEFAULT_M_COST = 19_456
 
   # The default 1 thread and compute lane recommended by OWASP.
   DEFAULT_PARALLELISM = 1

data/test/test_password.rb

@@ -74,13 +74,33 @@ class TestPassword < Minitest::Test
     refute password.is_password?("notopensesame")
   end
 
-  def test_raises_if_verifying_with_invalid_encoded_password
-    password = Argon2id::Password.new("invalid")
+  def test_salt_returns_the_original_salt
+    password = Argon2id::Password.new("$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4")
 
-    error = assert_raises(Argon2id::Error) do
-      password.is_password?("opensesame")
+    assert_equal "somesalt", password.salt
+  end
+
+  def test_salt_returns_raw_bytes
+    password = Argon2id::Password.new("$argon2id$v=19$m=256,t=2,p=1$KmIxrXv4lrnSJPO0LN7Gdw$lB3724qLPL9MNi10lkvIb4VxIk3q841CLvq0WTCZ0VQ")
+
+    assert_equal "*b1\xAD{\xF8\x96\xB9\xD2$\xF3\xB4,\xDE\xC6w".b, password.salt
+  end
+
+  def test_raises_for_invalid_hashes
+    assert_raises(ArgumentError) do
+      Argon2id::Password.new("not a valid hash")
     end
+  end
+
+  def test_raises_for_partial_hashes
+    assert_raises(ArgumentError) do
+      Argon2id::Password.new("$argon2id$v=19$m=256,t=2,p=1$KmIxrXv4lrnSJPO0LN7Gdw")
+    end
+  end
+
+  def test_salt_supports_versionless_hashes
+    password = Argon2id::Password.new("$argon2id$m=256,t=2,p=1$c29tZXNhbHQ$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4")
 
-    assert_equal "Decoding failed", error.message
+    assert_equal "somesalt", password.salt
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: argon2id
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.2.0
 platform: x86-linux
 authors:
 - Paul Mucur
@@ -10,6 +10,20 @@ bindir: bin
 cert_chain: []
 date: 2024-11-01 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: base64
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rake-compiler
   requirement: !ruby/object:Gem::Requirement