argon2id 0.6.0 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6f52b40e15650850965678538bc94eb2aa34da651e62e536da3bbca058e3d2c3
-  data.tar.gz: 852859c505d84f7ec6bfd0045d1c1bafe52c24e1c59ef52ccca5e997cfe48aa3
+  metadata.gz: fe0651aa144c9dd31ce3eec05fff4a92b19f9c3123ccca67c2f19ae0e0047e85
+  data.tar.gz: fdc003fc28fd0258bf838c599f5a7bf784296aefbd3658efc87e6ca23a9ea4a4
 SHA512:
-  metadata.gz: e89d4b69c0b98da64ff04c4dc15496ffe8cd11418fd4e466dcf382eca137b65b2301ad4c56f62a4387938067b4346269f7c6408d0ac498f6ef7359fe2224e3de
-  data.tar.gz: 9a31d89ff9bbd79294342c269c53ffd22574135ccde8c96c4efe99d772da1265a479964d031c0d6cd7e3b6923a383d0497dda78da6562faadc7f1af85f6ce1da
+  metadata.gz: b6eae30f919739df31878696ec9ce8d2bfd26bbc4c8dfe8a442021d139b51c80c6bc362c9810cad9dc706b4f32d36333ca85bbcdd5620ae169981d6766fd3d8c
+  data.tar.gz: d9c614f7e76e809677402b3f451b932ccfe413775d4bbf27131552f4c6249f819cef39db7285a85f5f91aaa37ad4b2f3cde6f24545f9d7eb412598df3cdcdbb8

data/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.7.0] - 2024-11-08
+
+### Fixed
+
+- Fixed verifying Argon2id encoded hashes without a version number on JRuby
+
+### Added
+
+- Added a new `Argon2id::Password.valid_hash?` API for testing if a given
+  encoded hash is a valid Argon2id hash or not (e.g. if you want to check
+  which hashing function was used to store a user's password)
+
 ## [0.6.0] - 2024-11-05
 
 ### Changed
@@ -99,6 +111,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   reference C implementation of Argon2, the password-hashing function that won
   the Password Hashing Competition.
 
+[0.7.0]: https://github.com/mudge/argon2id/releases/tag/v0.7.0
 [0.6.0]: https://github.com/mudge/argon2id/releases/tag/v0.6.0
 [0.5.0]: https://github.com/mudge/argon2id/releases/tag/v0.5.0
 [0.4.1]: https://github.com/mudge/argon2id/releases/tag/v0.4.1

data/README.md

@@ -5,7 +5,7 @@ Ruby bindings to [Argon2][], the password-hashing function that won the 2015
 
 [![Build Status](https://github.com/mudge/argon2id/actions/workflows/tests.yml/badge.svg?branch=main)](https://github.com/mudge/argon2id/actions)
 
-**Current version:** 0.6.0  
+**Current version:** 0.7.0  
 **Bundled Argon2 version:** libargon2.1 (20190702)
 
 ```ruby
@@ -26,6 +26,7 @@ password.salt   #=> "e-\xA7\x04U\x81\xA6{v\xF0x\xED\xCC\xD3\x96\xE3"
 * [Usage](#usage)
     * [Hashing passwords](#hashing-passwords)
     * [Verifying passwords](#verifying-passwords)
+    * [Validating encoded hashes](#validating-encoded-hashes)
     * [Errors](#errors)
 * [Requirements](#requirements)
     * [Native gems](#native-gems)
@@ -55,6 +56,8 @@ password.salt   #=> "e-\xA7\x04U\x81\xA6{v\xF0x\xED\xCC\xD3\x96\xE3"
 
 — [OWASP Password Storage Cheat Sheet][]
 
+See also [argon2-cffi's "Why 'just use bcrypt' Is Not the Best Answer (Anymore)"](https://argon2-cffi.readthedocs.io/en/23.1.0/argon2.html#why-just-use-bcrypt-is-not-the-best-answer-anymore).
+
 ## Usage
 
 Install argon2id as a dependency:
@@ -147,6 +150,18 @@ password.is_password?("opensesame")    #=> true
 password.is_password?("notopensesame") #=> false
 ```
 
+> [!CAUTION]
+> `Argon2id::Password#==` only works if the plain text password is on the right, e.g. the following behaviour may be surprising:
+>
+> ```ruby
+> password = Argon2id::Password.create("password")
+> password == "password" #=> true
+> "password" == password #=> false
+> password == password   #=> false
+> ```
+>
+> If you want to avoid this ambiguity, prefer the `Argon2id::Password#is_password?` alias instead.
+
 The various parts of the encoded hash can be retrieved:
 
 ```ruby
@@ -160,6 +175,18 @@ password.output
 #=> "\x9D\xFE\xB9\x10\xE8\v\xAD\x03\x11\xFE\xE2\x0F\x9C\x0E+\x12\xC1y\x87\xB4\xCA\xC9\f.\xF5M[0!\xC6\x8B\xFE"
 ```
 
+### Validating encoded hashes
+
+If you need to check ahead of time whether an encoded password hash is a valid Argon2id hash (e.g. if you're migrating between hashing functions and need to test what kind of password has been stored for a user), you can use `Argon2id::Password.valid_hash?` like so:
+
+```ruby
+Argon2id::Password.valid_hash?("$argon2id$v=19$m=65536,t=2,p=1$c29tZXNhbHQ$CTFhFdXPJO1aFaMaO6Mm5c8y7cJHAph8ArZWb2GRPPc")
+#=> true
+
+Argon2id::Password.valid_hash?("$2a$12$stsRn7Mi9r02.keRyF4OK.Aq4UWOU185lWggfUQfcupAi.b7AI/nS")
+#=> false
+```
+
 ### Errors
 
 Any errors returned from Argon2 will be raised as `Argon2id::Error`, e.g.
@@ -201,11 +228,11 @@ notes](https://github.com/mudge/argon2id/releases) for each version and can be
 checked with `sha256sum`, e.g.
 
 ```console
-$ gem fetch argon2id -v 0.5.0
-Fetching argon2id-0.5.0-arm64-darwin.gem
-Downloaded argon2id-0.5.0-arm64-darwin
-$ sha256sum argon2id-0.5.0-arm64-darwin.gem
-871e9d9bcad09e75620ce9ddd32cd99a4ebc3a6db1516e487680787faa7368a3  argon2id-0.5.0-arm64-darwin.gem
+$ gem fetch argon2id -v 0.6.0
+Fetching argon2id-0.6.0-arm64-darwin.gem
+Downloaded argon2id-0.6.0-arm64-darwin
+$ sha256sum argon2id-0.6.0-arm64-darwin.gem
+18f1f04be4b5e7badb4d491762e57874febeeb46c64ce1b0a5e3a75b39b5baeb  argon2id-0.6.0-arm64-darwin.gem
 ```
 
 [GPG](https://www.gnupg.org/) signatures are attached to each release (the
@@ -215,8 +242,8 @@ from a public keyserver, e.g. `gpg --keyserver keyserver.ubuntu.com --recv-key
 0x39AC3530070E0F75`):
 
 ```console
-$ gpg --verify argon2id-0.5.0-arm64-darwin.gem.sig argon2id-0.5.0-arm64-darwin.gem
-gpg: Signature made Sat  2 Nov 21:09:51 2024 GMT
+$ gpg --verify argon2id-0.6.0-arm64-darwin.gem.sig argon2id-0.6.0-arm64-darwin.gem
+gpg: Signature made Tue  5 Nov 11:30:47 2024 GMT
 gpg:                using RSA key 702609D9C790F45B577D7BEC39AC3530070E0F75
 gpg: Good signature from "Paul Mucur <mudge@mudge.name>" [unknown]
 gpg:                 aka "Paul Mucur <paul@ghostcassette.com>" [unknown]

data/argon2id.gemspec

@@ -48,7 +48,8 @@ Gem::Specification.new do |s|
     "lib/argon2id/extension.rb",
     "lib/argon2id/password.rb",
     "lib/argon2id/version.rb",
-    "test/test_password.rb"
+    "test/argon2id/test_password.rb",
+    "test/test_argon2id.rb"
   ]
   s.rdoc_options = ["--main", "README.md"]
 

data/lib/argon2id/extension.rb

@@ -47,6 +47,7 @@ if RUBY_PLATFORM == "java"
           .with_parallelism(parallelism)
           .with_memory_as_kb(m_cost)
           .with_iterations(t_cost)
+          .with_version(version)
           .build
         generator = Java::OrgBouncycastleCryptoGenerators::Argon2BytesGenerator.new
         generator.init(params)

data/lib/argon2id/password.rb

@@ -100,6 +100,13 @@ module Argon2id
       )
     end
 
+    # Check an encoded hash is a valid Argon2id hash.
+    #
+    # Returns true if so and false if not.
+    def self.valid_hash?(encoded)
+      PATTERN.match?(String(encoded))
+    end
+
     # Create a new Password with the given encoded password hash.
     #
     #   password = Argon2id::Password.new("$argon2id$v=19$m=19456,t=2,p=1$FI8yp1gXbthJCskBlpKPoQ$nOfCCpS2r+I8GRN71cZND4cskn7YKBNzuHUEO3YpY2s")

data/lib/argon2id/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Argon2id
-  VERSION = "0.6.0"
+  VERSION = "0.7.0"
 end

data/test/argon2id/test_password.rb

@@ -0,0 +1,548 @@
+# frozen_string_literal: true
+
+require "minitest/autorun"
+require "argon2id"
+
+class StringLike
+  def initialize(str)
+    @str = str
+  end
+
+  def to_s
+    @str
+  end
+end
+
+class TestPassword < Minitest::Test
+  def test_valid_hash_with_argon2id_hash_returns_true
+    assert Argon2id::Password.valid_hash?(
+      "$argon2id$v=19$m=65536,t=2,p=1$c29tZXNhbHQ" \
+      "$CTFhFdXPJO1aFaMaO6Mm5c8y7cJHAph8ArZWb2GRPPc"
+    )
+  end
+
+  def test_valid_hash_with_versionless_argon2id_hash_returns_true
+    assert Argon2id::Password.valid_hash?(
+      "$argon2id$m=65536,t=2,p=1$c29tZXNhbHQ" \
+      "$CTFhFdXPJO1aFaMaO6Mm5c8y7cJHAph8ArZWb2GRPPc"
+    )
+  end
+
+  def test_valid_hash_with_argon2i_hash_returns_false
+    refute Argon2id::Password.valid_hash?(
+      "$argon2i$m=65536,t=2,p=1$c29tZXNhbHQ" \
+      "$9sTbSlTio3Biev89thdrlKKiCaYsjjYVJxGAL3swxpQ"
+    )
+  end
+
+  def test_valid_hash_with_partial_argon2id_hash_returns_false
+    refute Argon2id::Password.valid_hash?(
+      "$argon2id$v=19$m=65536,t=2,p=1$c29tZXNhbHQ"
+    )
+  end
+
+  def test_valid_hash_with_argon2id_hash_with_null_bytes_returns_false
+    refute Argon2id::Password.valid_hash?(
+      "$argon2id$v=19$m=65536,t=2,p=1$c29tZXNhbHQ" \
+      "$CTFhFdXPJO1aFaMaO6Mm5c8y7cJHAph8ArZWb2GRPPc\x00foo"
+    )
+  end
+
+  def test_valid_hash_with_bcrypt_hash_returns_false
+    refute Argon2id::Password.valid_hash?(
+      "$2a$12$stsRn7Mi9r02.keRyF4OK.Aq4UWOU185lWggfUQfcupAi.b7AI/nS"
+    )
+  end
+
+  def test_valid_hash_with_nil_returns_false
+    refute Argon2id::Password.valid_hash?(nil)
+  end
+
+  def test_valid_hash_with_coercible_argon2id_hash_returns_true
+    assert Argon2id::Password.valid_hash?(
+      StringLike.new(
+        "$argon2id$v=19$m=65536,t=2,p=1$c29tZXNhbHQ" \
+        "$CTFhFdXPJO1aFaMaO6Mm5c8y7cJHAph8ArZWb2GRPPc"
+      )
+    )
+  end
+
+  def test_valid_hash_with_coercible_bcrypt_hash_returns_false
+    refute Argon2id::Password.valid_hash?(
+      StringLike.new(
+        "$2a$12$stsRn7Mi9r02.keRyF4OK.Aq4UWOU185lWggfUQfcupAi.b7AI/nS"
+      )
+    )
+  end
+
+  def test_new_m_65536_t_2_p_1_equals_password
+    password = Argon2id::Password.new(
+      "$argon2id$v=19$m=65536,t=2,p=1$c29tZXNhbHQ" \
+      "$CTFhFdXPJO1aFaMaO6Mm5c8y7cJHAph8ArZWb2GRPPc"
+    )
+
+    assert password == "password"
+  end
+
+  def test_new_m_262144_t_2_p_1_equals_password
+    password = Argon2id::Password.new(
+      "$argon2id$v=19$m=262144,t=2,p=1$c29tZXNhbHQ" \
+      "$eP4eyR+zqlZX1y5xCFTkw9m5GYx0L5YWwvCFvtlbLow"
+    )
+
+    assert password == "password"
+  end
+
+  def test_new_m_256_t_2_p_1_equals_password
+    password = Argon2id::Password.new(
+      "$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ" \
+      "$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4"
+    )
+
+    assert password == "password"
+  end
+
+  def test_new_m_256_t_2_p_2_equals_password
+    password = Argon2id::Password.new(
+      "$argon2id$v=19$m=256,t=2,p=2$c29tZXNhbHQ" \
+      "$bQk8UB/VmZZF4Oo79iDXuL5/0ttZwg2f/5U52iv1cDc"
+    )
+
+    assert password == "password"
+  end
+
+  def test_new_m_65536_t_1_p_1_equals_password
+    password = Argon2id::Password.new(
+      "$argon2id$v=19$m=65536,t=1,p=1$c29tZXNhbHQ" \
+      "$9qWtwbpyPd3vm1rB1GThgPzZ3/ydHL92zKL+15XZypg"
+    )
+
+    assert password == "password"
+  end
+
+  def test_new_m_65536_t_4_p_1_equals_password
+    password = Argon2id::Password.new(
+      "$argon2id$v=19$m=65536,t=4,p=1$c29tZXNhbHQ" \
+      "$kCXUjmjvc5XMqQedpMTsOv+zyJEf5PhtGiUghW9jFyw"
+    )
+
+    assert password == "password"
+  end
+
+  def test_new_m_65536_t_2_p_1_equals_differentpassword
+    password = Argon2id::Password.new(
+      "$argon2id$v=19$m=65536,t=2,p=1$c29tZXNhbHQ" \
+      "$C4TWUs9rDEvq7w3+J4umqA32aWKB1+DSiRuBfYxFj94"
+    )
+
+    assert password == "differentpassword"
+  end
+
+  def test_new_m_65536_t_2_p_1_with_diffsalt_equals_password
+    password = Argon2id::Password.new(
+      "$argon2id$v=19$m=65536,t=2,p=1$ZGlmZnNhbHQ" \
+      "$vfMrBczELrFdWP0ZsfhWsRPaHppYdP3MVEMIVlqoFBw"
+    )
+
+    assert password == "password"
+  end
+
+  def test_new_with_versionless_hash_equals_password
+    password = Argon2id::Password.new(
+      "$argon2id$m=256,t=2,p=1$c29tZXNhbHQ" \
+      "$2gcOV25Q8vOKPIl8vdxsf7QCjocJcf+erntOGHkpXm4"
+    )
+
+    assert password == "password"
+  end
+
+  def test_new_with_non_argon2id_hash_raises_argument_error
+    assert_raises(ArgumentError) do
+      Argon2id::Password.new(
+        "$argon2i$m=65536,t=2,p=1$c29tZXNhbHQ" \
+        "$9sTbSlTio3Biev89thdrlKKiCaYsjjYVJxGAL3swxpQ"
+      )
+    end
+  end
+
+  def test_new_with_invalid_hash_raises_argument_error
+    assert_raises(ArgumentError) do
+      Argon2id::Password.new("not a valid hash")
+    end
+  end
+
+  def test_new_with_nil_raises_argument_error
+    assert_raises(ArgumentError) do
+      Argon2id::Password.new(nil)
+    end
+  end
+
+  def test_new_with_coercible_equals_password
+    password = Argon2id::Password.new(
+      StringLike.new(
+        "$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ" \
+        "$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4"
+      )
+    )
+
+    assert password == "password"
+  end
+
+  def test_encoded_returns_the_full_encoded_hash
+    password = Argon2id::Password.new(
+      "$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ" \
+      "$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4"
+    )
+
+    assert_equal(
+      "$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4",
+      password.encoded
+    )
+  end
+
+  def test_version_returns_the_version
+    password = Argon2id::Password.new(
+      "$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ" \
+      "$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4"
+    )
+
+    assert_equal(19, password.version)
+  end
+
+  def test_version_with_no_version_returns_the_default_version
+    password = Argon2id::Password.new(
+      "$argon2id$m=256,t=2,p=1$c29tZXNhbHQ" \
+      "$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4"
+    )
+
+    assert_equal(16, password.version)
+  end
+
+  def test_m_cost_returns_m_cost
+    password = Argon2id::Password.new(
+      "$argon2id$m=256,t=2,p=1$c29tZXNhbHQ" \
+      "$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4"
+    )
+
+    assert_equal(256, password.m_cost)
+  end
+
+  def test_t_cost_returns_t_cost
+    password = Argon2id::Password.new(
+      "$argon2id$m=256,t=2,p=1$c29tZXNhbHQ" \
+      "$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4"
+    )
+
+    assert_equal(2, password.t_cost)
+  end
+
+  def test_parallelism_returns_parallelism
+    password = Argon2id::Password.new(
+      "$argon2id$m=256,t=2,p=1$c29tZXNhbHQ" \
+      "$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4"
+    )
+
+    assert_equal(1, password.parallelism)
+  end
+
+  def test_salt_returns_decoded_salt
+    password = Argon2id::Password.new(
+      "$argon2id$m=256,t=2,p=1$c29tZXNhbHQ" \
+      "$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4"
+    )
+
+    assert_equal("somesalt", password.salt)
+  end
+
+  def test_salt_returns_decoded_binary_salt
+    password = Argon2id::Password.new(
+      "$argon2id$v=19$m=256,t=2,p=1$FImSDfu1p8vf1mZBL2PCkg" \
+      "$vG4bIkTJGMx6OvkLuKTeq37DTyAf8gF2Ouf3zSLlYVc"
+    )
+
+    assert_equal(
+      "\x14\x89\x92\r\xFB\xB5\xA7\xCB\xDF\xD6fA/c\xC2\x92".b,
+      password.salt
+    )
+  end
+
+  def test_output_returns_decoded_output
+    password = Argon2id::Password.new(
+      "$argon2id$v=19$m=65536,t=1,p=1$c29tZXNhbHQ" \
+      "$9qWtwbpyPd3vm1rB1GThgPzZ3/ydHL92zKL+15XZypg"
+    )
+
+    assert_equal(
+      "\xF6\xA5\xAD\xC1\xBAr=\xDD\xEF\x9BZ\xC1\xD4d\xE1\x80\xFC\xD9\xDF\xFC\x9D\x1C\xBFv\xCC\xA2\xFE\xD7\x95\xD9\xCA\x98".b,
+      password.output
+    )
+  end
+
+  def test_to_s_returns_the_full_encoded_hash
+    password = Argon2id::Password.new(
+      "$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ" \
+      "$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4"
+    )
+
+    assert_equal(
+      "$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4",
+      password.to_s
+    )
+  end
+
+  def test_equals_correct_password_returns_true
+    password = Argon2id::Password.new(
+      "$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ" \
+      "$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4"
+    )
+
+    assert password == "password"
+  end
+
+  def test_equals_incorrect_password_returns_false
+    password = Argon2id::Password.new(
+      "$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ" \
+      "$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4"
+    )
+
+    refute password == "differentpassword"
+  end
+
+  def test_equals_nil_returns_false
+    password = Argon2id::Password.new(
+      "$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ" \
+      "$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4"
+    )
+
+    refute password == nil
+  end
+
+  def test_equals_coercible_correct_password_returns_true
+    password = Argon2id::Password.new(
+      "$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ" \
+      "$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4"
+    )
+
+    assert password == StringLike.new("password")
+  end
+
+  def test_equals_coercible_incorrect_password_returns_false
+    password = Argon2id::Password.new(
+      "$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ" \
+      "$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4"
+    )
+
+    refute password == StringLike.new("differentpassword")
+  end
+
+  def test_is_password_correct_password_returns_true
+    password = Argon2id::Password.new(
+      "$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ" \
+      "$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4"
+    )
+
+    assert password.is_password?("password")
+  end
+
+  def test_is_password_incorrect_password_returns_false
+    password = Argon2id::Password.new(
+      "$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ" \
+      "$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4"
+    )
+
+    refute password.is_password?("differentpassword")
+  end
+
+  def test_is_password_nil_returns_false
+    password = Argon2id::Password.new(
+      "$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ" \
+      "$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4"
+    )
+
+    refute password.is_password?(nil)
+  end
+
+  def test_is_password_coercible_correct_password_returns_true
+    password = Argon2id::Password.new(
+      "$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ" \
+      "$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4"
+    )
+
+    assert password.is_password?(StringLike.new("password"))
+  end
+
+  def test_is_password_coercible_incorrect_password_returns_false
+    password = Argon2id::Password.new(
+      "$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ" \
+      "$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4"
+    )
+
+    refute password.is_password?(StringLike.new("differentpassword"))
+  end
+
+  def test_create_password_returns_password
+    password = Argon2id::Password.create("password")
+
+    assert_instance_of Argon2id::Password, password
+  end
+
+  def test_create_password_uses_default_t_cost
+    password = Argon2id::Password.create("password")
+
+    assert_equal 2, password.t_cost
+  end
+
+  def test_create_password_uses_default_m_cost
+    password = Argon2id::Password.create("password")
+
+    assert_equal 19_456, password.m_cost
+  end
+
+  def test_create_password_uses_default_parallelism
+    password = Argon2id::Password.create("password")
+
+    assert_equal 1, password.parallelism
+  end
+
+  def test_create_password_uses_default_salt_len
+    password = Argon2id::Password.create("password")
+
+    assert_equal 16, password.salt.bytesize
+  end
+
+  def test_create_password_uses_default_output_len
+    password = Argon2id::Password.create("password")
+
+    assert_equal 32, password.output.bytesize
+  end
+
+  def test_create_password_with_t_cost_changes_t_cost
+    password = Argon2id::Password.create("password", t_cost: 1)
+
+    assert_equal(1, password.t_cost)
+  end
+
+  def test_create_password_with_too_small_t_cost_raises_error
+    assert_raises(Argon2id::Error) do
+      Argon2id::Password.create("password", t_cost: 0)
+    end
+  end
+
+  def test_create_password_with_m_cost_changes_m_cost
+    password = Argon2id::Password.create("password", m_cost: 8)
+
+    assert_equal(8, password.m_cost)
+  end
+
+  def test_create_password_with_too_small_m_cost_raises_error
+    assert_raises(Argon2id::Error) do
+      Argon2id::Password.create("password", m_cost: 0)
+    end
+  end
+
+  def test_create_password_with_parallelism_changes_parallelism
+    password = Argon2id::Password.create("password", parallelism: 2)
+
+    assert_equal(2, password.parallelism)
+  end
+
+  def test_create_password_with_too_small_parallelism_raises_error
+    assert_raises(Argon2id::Error) do
+      Argon2id::Password.create("password", parallelism: 0)
+    end
+  end
+
+  def test_create_password_with_too_small_salt_raises_error
+    assert_raises(Argon2id::Error) do
+      Argon2id::Password.create("password", salt_len: 0)
+    end
+  end
+
+  def test_create_password_with_output_len_changes_output_len
+    password = Argon2id::Password.create("password", output_len: 8)
+
+    assert_equal 8, password.output.bytesize
+  end
+
+  def test_create_password_with_too_output_len_raises_error
+    assert_raises(Argon2id::Error) do
+      Argon2id::Password.create("password", output_len: 0)
+    end
+  end
+
+  def test_create_password_inherits_t_cost_from_argon2id
+    Argon2id.t_cost = 1
+
+    password = Argon2id::Password.create("password")
+
+    assert_equal(1, password.t_cost)
+  ensure
+    Argon2id.t_cost = Argon2id::DEFAULT_T_COST
+  end
+
+  def test_create_password_inherits_m_cost_from_argon2id
+    Argon2id.m_cost = 8
+
+    password = Argon2id::Password.create("password")
+
+    assert_equal(8, password.m_cost)
+  ensure
+    Argon2id.m_cost = Argon2id::DEFAULT_M_COST
+  end
+
+  def test_create_password_inherits_parallelism_from_argon2id
+    Argon2id.parallelism = 2
+
+    password = Argon2id::Password.create("password")
+
+    assert_equal(2, password.parallelism)
+  ensure
+    Argon2id.parallelism = Argon2id::DEFAULT_PARALLELISM
+  end
+
+  def test_create_password_inherits_salt_len_from_argon2id
+    Argon2id.salt_len = 8
+
+    password = Argon2id::Password.create("password")
+
+    assert_equal(8, password.salt.bytesize)
+  ensure
+    Argon2id.salt_len = Argon2id::DEFAULT_SALT_LEN
+  end
+
+  def test_create_password_inherits_output_len_from_argon2id
+    Argon2id.output_len = 8
+
+    password = Argon2id::Password.create("password")
+
+    assert_equal(8, password.output.bytesize)
+  ensure
+    Argon2id.output_len = Argon2id::DEFAULT_OUTPUT_LEN
+  end
+
+  def test_create_password_equals_correct_password
+    password = Argon2id::Password.create("password")
+
+    assert password == "password"
+  end
+
+  def test_create_password_does_not_equal_incorrect_password
+    password = Argon2id::Password.create("password")
+
+    refute password == "differentpassword"
+  end
+
+  def test_hashing_password_verifies_correct_password
+    hash = Argon2id::Password.create("password").to_s
+    password = Argon2id::Password.new(hash)
+
+    assert password == "password"
+  end
+
+  def test_hashing_password_does_not_verify_incorrect_password
+    hash = Argon2id::Password.create("password").to_s
+    password = Argon2id::Password.new(hash)
+
+    refute password == "differentpassword"
+  end
+end

data/test/test_argon2id.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+require "minitest/autorun"
+require "argon2id"
+
+class TestArgon2id < Minitest::Test
+  def test_t_cost_is_default_t_cost
+    assert_equal 2, Argon2id.t_cost
+  end
+
+  def test_m_cost_is_default_m_cost
+    assert_equal 19_456, Argon2id.m_cost
+  end
+
+  def test_parallelism_is_default_parallelism
+    assert_equal 1, Argon2id.parallelism
+  end
+
+  def test_salt_len_is_default_salt_len
+    assert_equal 16, Argon2id.salt_len
+  end
+
+  def test_output_len_is_default_output_len
+    assert_equal 32, Argon2id.output_len
+  end
+
+  def test_t_cost_can_be_overridden
+    Argon2id.t_cost = 1
+
+    assert_equal 1, Argon2id.t_cost
+  ensure
+    Argon2id.t_cost = Argon2id::DEFAULT_T_COST
+  end
+
+  def test_m_cost_can_be_overridden
+    Argon2id.m_cost = 256
+
+    assert_equal 256, Argon2id.m_cost
+  ensure
+    Argon2id.m_cost = Argon2id::DEFAULT_M_COST
+  end
+
+  def test_parallelism_can_be_overridden
+    Argon2id.parallelism = 2
+
+    assert_equal 2, Argon2id.parallelism
+  ensure
+    Argon2id.parallelism = Argon2id::DEFAULT_PARALLELISM
+  end
+
+  def test_salt_len_can_be_overridden
+    Argon2id.salt_len = 8
+
+    assert_equal 8, Argon2id.salt_len
+  ensure
+    Argon2id.salt_len = Argon2id::DEFAULT_SALT_LEN
+  end
+
+  def test_output_len_can_be_overridden
+    Argon2id.output_len = 16
+
+    assert_equal 16, Argon2id.output_len
+  ensure
+    Argon2id.output_len = Argon2id::DEFAULT_OUTPUT_LEN
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: argon2id
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.7.0
 platform: ruby
 authors:
 - Paul Mucur
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-11-05 00:00:00.000000000 Z
+date: 2024-11-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake-compiler
@@ -87,7 +87,8 @@ files:
 - lib/argon2id/extension.rb
 - lib/argon2id/password.rb
 - lib/argon2id/version.rb
-- test/test_password.rb
+- test/argon2id/test_password.rb
+- test/test_argon2id.rb
 homepage: https://github.com/mudge/argon2id
 licenses:
 - BSD-3-Clause
@@ -115,7 +116,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.16
+rubygems_version: 3.5.22
 signing_key: 
 specification_version: 4
 summary: Ruby bindings to Argon2

data/test/test_password.rb

@@ -1,232 +0,0 @@
-# frozen_string_literal: true
-
-require "minitest/autorun"
-require "argon2id"
-
-class TestPassword < Minitest::Test
-  def test_create_returns_encoded_password_with_defaults
-    password = Argon2id::Password.create("opensesame")
-
-    assert password.to_s.start_with?("$argon2id$")
-    assert password.to_s.include?("t=2")
-    assert password.to_s.include?("m=19456")
-  end
-
-  def test_create_options_can_override_parameters
-    password = Argon2id::Password.create("opensesame", t_cost: 2, m_cost: 256)
-
-    assert password.to_s.include?("t=2")
-    assert password.to_s.include?("m=256")
-  end
-
-  def test_create_uses_argon2id_configuration
-    Argon2id.t_cost = 2
-    Argon2id.m_cost = 256
-
-    password = Argon2id::Password.create("opensesame")
-
-    assert password.to_s.include?("t=2")
-    assert password.to_s.include?("m=256")
-  ensure
-    Argon2id.t_cost = Argon2id::DEFAULT_T_COST
-    Argon2id.m_cost = Argon2id::DEFAULT_M_COST
-  end
-
-  def test_create_coerces_pwd_to_string
-    password = Argon2id::Password.create(123, t_cost: 2, m_cost: 256)
-
-    assert password.to_s.start_with?("$argon2id$")
-  end
-
-  def test_create_coerces_costs_to_integer
-    password = Argon2id::Password.create("opensesame", t_cost: "2", m_cost: "256", parallelism: "1", salt_len: "8", output_len: "32")
-
-    assert password.to_s.start_with?("$argon2id$")
-  end
-
-  def test_create_raises_if_given_non_integer_costs
-    assert_raises(ArgumentError) do
-      Argon2id::Password.create("opensesame", t_cost: "not an integer")
-    end
-  end
-
-  def test_equals_correct_password
-    password = Argon2id::Password.create("opensesame", t_cost: 2, m_cost: 256)
-
-    assert password == "opensesame"
-  end
-
-  def test_does_not_equal_invalid_password
-    password = Argon2id::Password.create("opensesame", t_cost: 2, m_cost: 256)
-
-    refute password == "notopensesame"
-  end
-
-  def test_is_password_returns_true_with_correct_password
-    password = Argon2id::Password.create("opensesame", t_cost: 2, m_cost: 256)
-
-    assert password.is_password?("opensesame")
-  end
-
-  def test_is_password_returns_false_with_incorrect_password
-    password = Argon2id::Password.create("opensesame", t_cost: 2, m_cost: 256)
-
-    refute password.is_password?("notopensesame")
-  end
-
-  def test_salt_returns_the_original_salt
-    password = Argon2id::Password.new("$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4")
-
-    assert_equal "somesalt", password.salt
-  end
-
-  def test_salt_returns_raw_bytes
-    password = Argon2id::Password.new("$argon2id$v=19$m=256,t=2,p=1$KmIxrXv4lrnSJPO0LN7Gdw$lB3724qLPL9MNi10lkvIb4VxIk3q841CLvq0WTCZ0VQ")
-
-    assert_equal "*b1\xAD{\xF8\x96\xB9\xD2$\xF3\xB4,\xDE\xC6w".b, password.salt
-  end
-
-  def test_raises_for_invalid_hashes
-    assert_raises(ArgumentError) do
-      Argon2id::Password.new("not a valid hash")
-    end
-  end
-
-  def test_raises_for_partial_hashes
-    assert_raises(ArgumentError) do
-      Argon2id::Password.new("$argon2id$v=19$m=256,t=2,p=1$KmIxrXv4lrnSJPO0LN7Gdw")
-    end
-  end
-
-  def test_raises_for_hashes_with_null_bytes
-    assert_raises(ArgumentError) do
-      Argon2id::Password.new("$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4\x00foo")
-    end
-  end
-
-  def test_raises_for_non_argon2id_hashes
-    assert_raises(ArgumentError) do
-      Argon2id::Password.new("$argon2i$v=19$m=256,t=2,p=1$c29tZXNhbHQ$iekCn0Y3spW+sCcFanM2xBT63UP2sghkUoHLIUpWRS8")
-    end
-  end
-
-  def test_salt_supports_versionless_hashes
-    password = Argon2id::Password.new("$argon2id$m=256,t=2,p=1$c29tZXNhbHQ$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4")
-
-    assert_equal "somesalt", password.salt
-  end
-
-  def test_coerces_given_hash_to_string
-    password = Argon2id::Password.create("password")
-
-    assert Argon2id::Password.new(password) == "password"
-  end
-
-  def test_extracting_version_from_hash
-    password = Argon2id::Password.new("$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4")
-
-    assert_equal 19, password.version
-  end
-
-  def test_extracting_version_from_versionless_hash
-    password = Argon2id::Password.new("$argon2id$m=256,t=2,p=1$c29tZXNhbHQ$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4")
-
-    assert_equal 16, password.version
-  end
-
-  def test_extracting_time_cost_from_hash
-    password = Argon2id::Password.new("$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4")
-
-    assert_equal 2, password.t_cost
-  end
-
-  def test_extracting_time_cost_from_versionless_hash
-    password = Argon2id::Password.new("$argon2id$m=256,t=2,p=1$c29tZXNhbHQ$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4")
-
-    assert_equal 2, password.t_cost
-  end
-
-  def test_extracting_memory_cost_from_hash
-    password = Argon2id::Password.new("$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4")
-
-    assert_equal 256, password.m_cost
-  end
-
-  def test_extracting_memory_cost_from_versionless_hash
-    password = Argon2id::Password.new("$argon2id$m=256,t=2,p=1$c29tZXNhbHQ$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4")
-
-    assert_equal 256, password.m_cost
-  end
-
-  def test_extracting_parallelism_from_hash
-    password = Argon2id::Password.new("$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4")
-
-    assert_equal 1, password.parallelism
-  end
-
-  def test_extracting_parallelism_from_versionless_hash
-    password = Argon2id::Password.new("$argon2id$m=256,t=2,p=1$c29tZXNhbHQ$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4")
-
-    assert_equal 1, password.parallelism
-  end
-
-  def test_extracting_output_from_hash
-    password = Argon2id::Password.new("$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4")
-
-    assert_equal "\x9D\xFE\xB9\x10\xE8\v\xAD\x03\x11\xFE\xE2\x0F\x9C\x0E+\x12\xC1y\x87\xB4\xCA\xC9\f.\xF5M[0!\xC6\x8B\xFE".b, password.output
-  end
-
-  def test_libargon2_test_case_1
-    password = Argon2id::Password.new("$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4")
-
-    assert password == "password"
-  end
-
-  def test_libargon2_test_case_1_returns_false_with_incorrect_password
-    password = Argon2id::Password.new("$argon2id$v=19$m=256,t=2,p=1$c29tZXNhbHQ$nf65EOgLrQMR/uIPnA4rEsF5h7TKyQwu9U1bMCHGi/4")
-
-    refute password == "not password"
-  end
-
-  def test_libargon2_test_case_2
-    password = Argon2id::Password.new("$argon2id$v=19$m=256,t=2,p=2$c29tZXNhbHQ$bQk8UB/VmZZF4Oo79iDXuL5/0ttZwg2f/5U52iv1cDc")
-
-    assert password == "password"
-  end
-
-  def test_encoded_password_does_not_include_trailing_null_byte
-    password = Argon2id::Password.create("password", t_cost: 2, m_cost: 256, salt_len: 8)
-
-    refute password.to_s.end_with?("\x00")
-  end
-
-  def test_raises_with_too_short_output
-    assert_raises(Argon2id::Error) do
-      Argon2id::Password.create("password", t_cost: 2, m_cost: 256, salt_len: 8, output_len: 1)
-    end
-  end
-
-  def test_raises_with_too_few_threads_and_compute_lanes
-    assert_raises(Argon2id::Error) do
-      Argon2id::Password.create("password", t_cost: 2, m_cost: 256, parallelism: 0, salt_len: 8)
-    end
-  end
-
-  def test_raises_with_too_small_memory_cost
-    assert_raises(Argon2id::Error) do
-      Argon2id::Password.create("password", t_cost: 2, m_cost: 0, salt_len: 8)
-    end
-  end
-
-  def test_raises_with_too_small_time_cost
-    assert_raises(Argon2id::Error) do
-      Argon2id::Password.create("password", t_cost: 0, m_cost: 256, salt_len: 8)
-    end
-  end
-
-  def test_raises_with_too_short_salt
-    assert_raises(Argon2id::Error) do
-      Argon2id::Password.create("password", t_cost: 2, m_cost: 256, salt_len: 0)
-    end
-  end
-end