Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Independent implementation audit scope for RustCrypto argon2

Aperta
  • Qualcosa non va?
#940 2 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
38/100
Tipo di issue
Documentazione
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
rust
Ambito
cryptography, security

Direzione di ricerca

Start by checking the RustCrypto argon2 0.6.0 release and packaged revision b1e0ad6fe229b1ba74e4696c7359ab45d7e931f0 against publicly available independent review reports. The issue asks for report scope, audited revision, dependencies and features, findings, remediation references, and any mapping or follow-up for changes since the review. Done means providing a matching public report or auditor-authenticated scope statement, or establishing that no shareable report was located so the project can scope a review.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

We are evaluating RustCrypto argon2 for a local-first desktop vault whose project requirements retain an independent implementation-audit gate. Our proposed pin is argon2 0.6.0, package SHA-256 134c52ddac6d63c576bef8168db10c83c49c26444ecbc68060fef078925a901c, packaged VCS revision b1e0ad6fe229b1ba74e4696c7359ab45d7e931f0 (argon2 directory). The intended raw KDF profile is Argon2id v0x13, m=65536 KiB, t=3, p=4, with bounded import parameters. No vault implementation has begun.

Could you point us to any independent review report that actually includes this Rust Argon2 implementation, with the audited revision, dependency/feature scope, findings and remediation references? If the review predates this release, is there a published mapping or follow-up for relevant changes? A public report or auditor-authenticated scope statement would help; an algorithm review or an application merely depending on Argon2 would not establish the implementation coverage we need.

We found the NCC 2020 AEAD review, which does not include password-hashes, and the NCC 2021 opaque-ke report, which explicitly excludes its later Argon2 switch from the targeted release. We have not located matching evidence; we are not claiming that no review exists or that the implementation is insecure. If there is no shareable report, knowing that would help us scope an independent review rather than infer coverage.

Thank you for any pointers.

Lingua principale
Rust
Stelle
914
Fork
116
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di RustCrypto/password-hashes

Tutte le issue di RustCrypto/password-hashes

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.