Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Independent implementation audit scope for RustCrypto argon2

Abierto
  • ¿Algo no está bien?
#940 2 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
38/100
Tipo de issue
Documentación
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
rust
Área
cryptography, security

Línea de trabajo

Start by checking the RustCrypto argon2 0.6.0 release and packaged revision b1e0ad6fe229b1ba74e4696c7359ab45d7e931f0 against publicly available independent review reports. The issue asks for report scope, audited revision, dependencies and features, findings, remediation references, and any mapping or follow-up for changes since the review. Done means providing a matching public report or auditor-authenticated scope statement, or establishing that no shareable report was located so the project can scope a review.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

We are evaluating RustCrypto argon2 for a local-first desktop vault whose project requirements retain an independent implementation-audit gate. Our proposed pin is argon2 0.6.0, package SHA-256 134c52ddac6d63c576bef8168db10c83c49c26444ecbc68060fef078925a901c, packaged VCS revision b1e0ad6fe229b1ba74e4696c7359ab45d7e931f0 (argon2 directory). The intended raw KDF profile is Argon2id v0x13, m=65536 KiB, t=3, p=4, with bounded import parameters. No vault implementation has begun.

Could you point us to any independent review report that actually includes this Rust Argon2 implementation, with the audited revision, dependency/feature scope, findings and remediation references? If the review predates this release, is there a published mapping or follow-up for relevant changes? A public report or auditor-authenticated scope statement would help; an algorithm review or an application merely depending on Argon2 would not establish the implementation coverage we need.

We found the NCC 2020 AEAD review, which does not include password-hashes, and the NCC 2021 opaque-ke report, which explicitly excludes its later Argon2 switch from the targeted release. We have not located matching evidence; we are not claiming that no review exists or that the implementation is insecure. If there is no shareable report, knowing that would help us scope an independent review rather than infer coverage.

Thank you for any pointers.

Lenguaje dominante
Rust
Estrellas
914
Forks
116
Sin PR fusionados en 30 d

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de RustCrypto/password-hashes

Todos los issues de RustCrypto/password-hashes

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.