golang/go

x/crypto/argon2: docs on thread parameter might make users inadvertently create non-portable hashes

Open

#42,605 opened on Nov 14, 2020

View on GitHub
 (6 comments) (0 reactions) (0 assignees)Go (19,008 forks)batch import
DocumentationNeedsFixhelp wanted

Repository metrics

Stars
 (133,883 stars)
PR merge metrics
 (No merged PRs in 30d)

Description

Both IDKey and Key from golang.org/x/crypto/argon2 take a threads parameter which is documented as following:

The number of threads can be adjusted to the numbers of available CPUs.

While it's obviously wrong in hindsight, this sentence lead me to pass the (dynamic) value of runtime.NumCPU() as the value for threads when hashing passwords, which means the hashes Argon2 would create are different (i.e. stop matching) on hosts with different numbers of CPUs.

Would it make sense to extend the comments here to point out that threads is not purely performance related, but also has an effect on the hash output (e.g. by stating it needs to be a fixed value and you can use the number of CPUs as a guideline)?

Contributor guide

Research direction
Update the documentation for the `threads` parameter in `IDKey` and `Key` functions to clarify that it must be a fixed value and suggest using the number of CPUs as a guideline.
Tech stack
go
Domain
securitybackend
Issue type
Documentation
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
1
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Under 1 hour
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
Go
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
80