[Security] Argon2i Password Encoder #21604

zanbaldwin · 2017-02-13T21:51:33Z

Q	A
Branch?	master
Bug fix?	no
New feature?	yes
BC breaks?	no
Deprecations?	no
Tests pass?	yes
Fixed tickets
License	MIT
Doc PR	WIP

Since the libsodium RFC passed with flying colours, I'd like to kick start a discussion about adding Argon2i as a password encoder to the security component. The initial code proposal in this PR supports both the upcoming public API confirmed for PHP 7.2, and the libsodium PECL extension for those below 7.2 (available for PHP 5.4+).

Concerns

Should the test cover hash length? At the moment the result of Argon2i is 96 characters, but because the hashing parameters are included in the result ($argon2i$v=19$m=32768,t=4,p=1$...) this is not guaranteed.
I've used one password encoder class because the result should be the same whether running natively in 7.2 or from the PECL extension, but should the logic be split out into separate private methods (like Argon2iPasswordEncoder::encodePassword()) or not (like in Argon2iPasswordEncoder::isPasswordValid())? Since I can't really find anything concrete on Symfony choosing one way over another I'm assuming it's down to personal preference?

The Future

Whilst the libsodium RFC has been approved and the public API confirmed, there has been no confirmation of Argon2i becoming an official algorithm for passhword_hash(). If that is confirmed, then the implementation should absolutely use the native password_* functions since the sodium_* functions do not have an equivalent to the password_needs_rehash() function.

Any feedback would be greatly appreciated 😃

linaori · 2017-02-14T08:00:03Z

With the constant changing of recommended algorithms, would it be an idea to provide a migration layer in Symfony? Currently people will have to build this themselves, but it could be a lot easier if Symfony would provide an extension point, especially now that we can rehash with native php functions.

zanbaldwin · 2017-02-14T11:19:19Z

That's a great idea since Symfony really should be promoting security best practices (though likely out of the scope of this PR so I'll have a go at starting that separately - if you've got any ideas on what direction that would take, what the config would look like, etc).

It's pretty much a given that Argon2i will be the next hashing algorithm supported by password_hash() (and therefore password_needs_rehash()) in PHP 7.2 but I haven't actually found anywhere that confirms it - either way it won't become PASSWORD_DEFAULT until at least 7.3 😢

stof · 2017-02-14T11:27:57Z

is a new password encoder considered a new feature (therefore should be against master) or a security improvement/patch (therefore should be against 2.8)?

to me, it is a new feature

stof · 2017-02-14T11:30:12Z

Is a MAX_PASSWORD_LENGTH of 72 appropriate? Argon2i is, in terms of execution duration, generally along the lines of BCrypt with a cost of 11.

the max password length of 72 for bcrypt is because the bcrypt algorithm does not support longer passwords at all (it truncates the input at 72 chars).
If Argon2i does not have a 72 chars restriction, we should not add it here (keeping the much longer restriction we have in all other encoders)

stof · 2017-02-14T11:30:50Z

src/Symfony/Bundle/SecurityBundle/Resources/config/security.xml

@@ -14,6 +14,7 @@
        <parameter key="security.encoder.plain.class">Symfony\Component\Security\Core\Encoder\PlaintextPasswordEncoder</parameter>
        <parameter key="security.encoder.pbkdf2.class">Symfony\Component\Security\Core\Encoder\Pbkdf2PasswordEncoder</parameter>
        <parameter key="security.encoder.bcrypt.class">Symfony\Component\Security\Core\Encoder\BCryptPasswordEncoder</parameter>
+        <parameter key="security.encoder.argon2i.class">Symfony\Component\Security\Core\Encoder\Argon2iPasswordEncoder</parameter>


we don't use parameters for class names anymore

stof · 2017-02-14T11:33:12Z

src/Symfony/Bundle/SecurityBundle/Tests/Functional/UserPasswordEncoderCommandTest.php

+        if (PHP_VERSION_ID < 70200 && !extension_loaded('libsodium')) {
+            $this->markTestSkipped('Argon2i algorithm not available.');
+
+            return;


useless. markTestSkipped is throwing an exception to interrupt the execution of the test

stof · 2017-02-14T11:33:31Z

src/Symfony/Component/Security/Core/Encoder/Argon2iPasswordEncoder.php

+
+        if (PHP_VERSION_ID >= 70200) {
+            return $this->encodePasswordNative($raw);
+        } elseif (extension_loaded('libsodium')) {


stof · 2017-02-14T11:34:49Z

Please rebase this on top of master and change the target branch of the PR

zanbaldwin · 2017-02-14T11:59:41Z

All done, thanks. I'll update the MAX_PASSWORD_LENGTH once I can find some concrete evidence that Argon2i does not have the same length limitations as BCrypt.

stof · 2017-02-14T12:15:27Z

@zanderbaldwin if the algo does not explicitly says it truncates the input, it means it does not do it. you would have to look at the algo description.

stof · 2017-02-14T12:19:17Z

another solution to detect it experimentally: hash a very long password, and then verify it with a string changing a single char in the string. and keep doing it, by increasing the altered index little by little. Once you find a case where the altered string is accepted in verify, it means you passed over the accepted input length.
Of course, you don't need to increase 1 by 1 (unless you have days to spend on your machine for that, or a botnet to distribute the work). You can start with a high value and increase by big numbers, until you find an accepted mismatch, and then bisect the length being the max.

zanbaldwin · 2017-02-14T12:39:58Z

Confirmed, I tested up to 8192 characters and there are no false-positives from truncating. More than enough for a MAX_PASSWORD_LENGTH of 4096.

jedisct1 · 2017-02-14T18:05:21Z

You can safely use passwords up to 2^32-1 bits long.

derrabus · 2017-02-15T08:40:20Z

src/Symfony/Component/Security/Core/Encoder/Argon2iPasswordEncoder.php

+            throw new BadCredentialsException('Invalid password.');
+        }
+
+        if (PHP_VERSION_ID >= 70200) {


I'd prefer checking for features over versions whenever possible. In this case:

if (function_exists('sodium_crypto_pwhash_str')) {

What do you think?

I agree, feature checking is more reliable when you think of php on .net or hhvm.

Agree. I'll add that in today.
I'm also trying to find a definitive answer on whether PASSWORD_ARGON2I will be implemented for password_hash() which would be a better solution than sodium_crypto_passwd_str(), so that feature test could change.

stof · 2017-02-15T08:45:16Z

src/Symfony/Bundle/SecurityBundle/Command/UserPasswordEncoderCommand.php

@@ -94,11 +95,16 @@ protected function execute(InputInterface $input, OutputInterface $output)

        $encoder = $this->getContainer()->get('security.encoder_factory')->getEncoder($userClass);
        $bcryptWithoutEmptySalt = !$emptySalt && $encoder instanceof BCryptPasswordEncoder;
+        $argon2iWithoutEmptySalt = !$emptySalt && $encoder instanceof Argon2iPasswordEncoder;


I suggest adding a a marker interface on encoders not needing the salt externally, to avoid having to know them one by one (I have the same need for detecting them in FOSUserBundle 2 to avoid generating useless salts).
what do you think @symfony/deciders ?

+1 even though I'm not a decider; I wanted to do something like that but thought it would be adding too much for the scope of this PR.

Is that something I could implement here or separate PR?

let's do it separately indeed. But the introduction of this encoder makes it worth adding such feature.

zanbaldwin · 2017-03-13T10:27:01Z

Hi, all requested changes have been made and I've finally got round to fixing the conflicts with the latest version of master 👍

There will be conflicts with #21620 that I'll have to fix (most likely in this PR if #21620 gets merged first since it's been marked for 3.3).

xabbuh · 2017-03-13T14:27:28Z

src/Symfony/Component/Security/Core/Tests/Encoder/Argon2iPasswordEncoder.php

+
+    public function setUp()
+    {
+        if (PHP_VERSION_ID < 70200 && !extension_loaded('libsodium')) {


Isn't it possible to run the tests if libsodium is missing, but the sodium_crypto_pwhash_str(), sodium_memzero(), and sodium_crypto_pwhash_str_verify() functions do exist?

Yes, absolutely. I did change from version-checking to feature-checking in Argon2iPasswordEncoder but I unfortunately either forgot to update it here, or it snuck in whilst rebasing (either way I missed it and shall update when I get home from work).

The isPasswordValid() method checks for the function that it uses, but neither encodePassword() or isPasswordValid() check for the existence of sodium_memzero() - is this something that should be done in case one of the check functions has been defined in user-land code? It's a pretty far off edge-case but should at least be aknowledged...

One solution could be to check the result of ReflectionFunctionAbstract::isUserDefined, though would this be adding too much overhead?

nicolas-grekas · 2017-03-22T19:57:46Z

src/Symfony/Component/Security/Core/Encoder/EncoderFactory.php should also be updated to account for argon2

zanbaldwin · 2017-03-23T16:25:48Z

I've updated EncoderFactory but I admit that I didn't quite comprehend the EncoderFactoryTest to modify it appropriately; if this needs updating can someone point me in the right direction please?

sstok · 2017-06-18T11:13:04Z

EncoderFactoryTest doesn't need to be updated, both bcrypt and pbkdf2 are not listed in this test-class also.

sstok · 2017-06-18T11:14:41Z

src/Symfony/Component/Security/Core/Tests/Encoder/Argon2iPasswordEncoder.php

+/**
+ * @author Elnur Abdurrakhimov <[email protected]>
+ */
+class Argon2iPasswordEncoderTest extends \PHPUnit_Framework_TestCase


This needs to use PHPUnit\Framework\TestCase.

chalasr · 2017-09-09T10:39:19Z

Whilst the libsodium RFC has been approved and the public API confirmed, there has been no confirmation of Argon2i becoming an official algorithm for passhword_hash(). If that is confirmed, then the implementation should absolutely use the native password_* functions since the sodium_* functions do not have an equivalent to the password_needs_rehash() function.

Confirmed it is: PHP 7.2 introduces PASSWORD_ARGON2I as algo for password_hash() (see https://wiki.php.net/rfc/argon2_password_hash).

@zanderbaldwin What's the status of this PR? Could you finish it? Or do you want someone to take it over? I would like to get this in.

zanbaldwin · 2017-09-12T16:05:35Z

Sure, I'll get on this in the next few days.

Does anyone know a good way to determine if the constant PASSWORD_ARGON2I is user or core defined? I'd rather feature test than test PHP_VERSION_ID >= 70200.

I'm currently testing with the php:7.2.0RC1-alpine Docker image and the constant isn't defined yet (getting really weird behaviour on 3v4l.org too).

chalasr · 2017-09-14T08:26:00Z

@zanderbaldwin Just tried out, using defined('PASSWORD_ARGON2I') should do the job.
See https://3v4l.org/N8RCV

nicolas-grekas · 2017-09-26T12:31:20Z

@zanbaldwin would you have time to finish this PR for the end of the week?

zanbaldwin · 2017-09-26T13:31:05Z

I've made most of the changes. Some points I want to clarify are:

PASSWORD_ARGON2I could be user-defined in versions of PHP less than 7.2 so I also do version-testing. But I hate version checking instead of feature checking, so does anyone know of a better way of doing this?
There are three different ways to test for the presence of Sodium, do we need them all?
- PHP_VERSION_ID >= 70200 && defined('PASSWORD_ARGON2I') uses the built in password_hash() functions.
- function_exists('sodium_crypto_pwhash_str') uses the Sodium functions that are native in 7.2.
- extension_loaded('libsodium') uses the Sodium extension for PHP versions less than 7.2.

I'm thinking of getting rid of the function_exists('sodium_crypto_pwhash_str') check, but while testing on php:7.2.0RC2-alpine Docker image I've found that the constant PASSWORD_ARGON2I is not defined (but it works completely fine on 3v4l.org). Thoughts?

xabbuh · 2017-09-28T09:37:55Z

src/Symfony/Component/Security/Core/Encoder/Argon2iPasswordEncoder.php

+            return $this->encodePasswordSodiumExtension($raw);
+        }
+
+        throw new \LogicException('Argon2i algorithm is not supported. Please install libsodium extension or upgrade to PHP 7.2+.');


I wonder if we cannot already (also) do these checks inside SecurityExtension when the config is parsed? This would exclude WTF moments at runtime.

In the extension, it should be an InvalidConfigurationException

Okay, I've made the changes in the Security component, I'll get onto putting extra checks in the SecurityBundle config parser 🙂

same here, "install the libsodium extension" sounds better.

xabbuh · 2017-09-28T09:38:57Z

src/Symfony/Component/Security/Core/Encoder/Argon2iPasswordEncoder.php

+        throw new \LogicException('Argon2i algorithm is not supported. Please install libsodium extension or upgrade to PHP 7.2+.');
+    }
+
+    private function encodePasswordNative($raw)


private methods should come after public ones

xabbuh · 2017-09-28T09:39:22Z

src/Symfony/Component/Security/Core/Encoder/Argon2iPasswordEncoder.php

+    {
+        if (\PHP_VERSION_ID >= 70200 && defined('PASSWORD_ARGON2I')) {
+            $valid = !$this->isPasswordTooLong($raw) && password_verify($raw, $encoded);
+        } elseif (function_exists('sodium_crypto_pwhash_str_verify')) {


I would use early returns instead of elseif

zanbaldwin · 2017-09-28T12:42:18Z

I've made some changes, but committed them in a separate commit (which can be squashed later).

Update all exception messages regarding the Argon2i algorithm not being supported to be the same string.
Add a static helper method on the Argon2iPasswordEncoder class, all checks throughout the Security component and SecurityBundle use the same method. If this changes, it only needs to be updated in one place.
Added a check in the SecurityExtension. Is this the correct place to put it, or should the check be directly in the MainConfiguration class using config validation callbacks?

Feedback welcomed, as always 👍

xabbuh · 2017-09-28T12:43:22Z

tests are currently failing (see the CI builds) :)

fabpot

with minor text comments

fabpot · 2017-09-28T12:43:40Z

src/Symfony/Bundle/SecurityBundle/CHANGELOG.md

@@ -14,6 +14,7 @@ CHANGELOG
 * deprecated HTTP digest authentication
 * deprecated command `acl:set` along with `SetAclCommand` class
 * deprecated command `init:acl` along with `InitAclCommand` class
+ * Added support for the new Argon2i password encoder.


minor: dot at the end should be removed

fabpot · 2017-09-28T12:44:08Z

src/Symfony/Bundle/SecurityBundle/DependencyInjection/SecurityExtension.php

+        // Argon2i encoder
+        if ('argon2i' === $config['algorithm']) {
+            if (!Argon2iPasswordEncoder::isSupported()) {
+                throw new InvalidConfigurationException('Argon2i algorithm is not supported. Please install libsodium extension or upgrade to PHP 7.2+.');


install the libsodium extension?

fabpot · 2017-09-28T12:44:26Z

src/Symfony/Component/Security/CHANGELOG.md

@@ -13,6 +13,7 @@ CHANGELOG
   the user will always be logged out when the user has changed between
   requests.
 * deprecated HTTP digest authentication
+ * Added a new password encoder for the Argon2i hashing algorithm.


same, no dot

fabpot · 2017-09-28T12:45:00Z

src/Symfony/Component/Security/Core/Encoder/Argon2iPasswordEncoder.php

+use Symfony\Component\Security\Core\Exception\BadCredentialsException;
+
+/**
+ * Argon2iPasswordEncoder uses the Argon2i hashing algorithm provided by libsodium.


I would remove the "provided by libsodium" part, which is an implementation detail.

fabpot · 2017-09-28T12:45:49Z

src/Symfony/Component/Security/Core/Encoder/Argon2iPasswordEncoder.php

+            return $valid;
+        }
+
+        throw new \LogicException('Argon2i algorithm is not supported. Please install libsodium extension or upgrade to PHP 7.2+.');


same here, "install the libsodium extension" sounds better.

fabpot · 2017-09-28T12:45:52Z

src/Symfony/Component/Security/Core/Encoder/Argon2iPasswordEncoder.php

+            return $this->encodePasswordSodiumExtension($raw);
+        }
+
+        throw new \LogicException('Argon2i algorithm is not supported. Please install libsodium extension or upgrade to PHP 7.2+.');


same here, "install the libsodium extension" sounds better.

zanbaldwin · 2017-09-28T12:47:33Z

That's because Travis installs the symfony/security package as version dev-master 45020b8 rather than using the Security component code of this PR.

xabbuh · 2017-09-28T13:08:57Z

@zanbaldwin In fact, the code is right (at least on the PHP 5.5 build, see https://travis-ci.org/symfony/symfony/jobs/280855177#L3622), but the Argon2i algorithm is not available. Tests should reflect this possibility.

stof · 2017-09-28T12:53:08Z

src/Symfony/Component/Security/Core/Encoder/Argon2iPasswordEncoder.php

+    {
+        return function_exists('sodium_crypto_pwhash_str')
+            || extension_loaded('libsodium')
+            || (\PHP_VERSION_ID >= 70200 && defined('PASSWORD_ARGON2I'));


defined must be fully-qualified, so that it can be resolved at compile time when the constant is defined in PHP itself (which is the case when it is set on PHP 7.2+).

and the PHP 7.2 case should be there first, so that OPcache can optimize the code. return true || function_exists('sodium_crypto_pwhash_str') || extension_loaded('libsodium') can be optimized into return true. But return function_exists('sodium_crypto_pwhash_str') || extension_loaded('libsodium') || true cannot (as earlier branches of the boolean condition must be evaluated first in PHP)

stof · 2017-09-28T12:53:37Z

src/Symfony/Component/Security/Core/Encoder/Argon2iPasswordEncoder.php

+            throw new BadCredentialsException('Invalid password.');
+        }
+
+        if (\PHP_VERSION_ID >= 70200 && defined('PASSWORD_ARGON2I')) {


defined should be fully qualified here too for optimizations

stof · 2017-09-28T12:53:46Z

src/Symfony/Component/Security/Core/Encoder/Argon2iPasswordEncoder.php

+     */
+    public function isPasswordValid($encoded, $raw, $salt)
+    {
+        if (\PHP_VERSION_ID >= 70200 && defined('PASSWORD_ARGON2I')) {


defined should be fully qualified here too for optimizations

chalasr

almost good :)

chalasr · 2017-09-28T13:12:42Z

src/Symfony/Component/Security/Core/Tests/Encoder/Argon2iPasswordEncoderTest.php

+{
+    const PASSWORD = 'password';
+
+    public function setUp()


should be protected

chalasr · 2017-09-28T13:16:08Z

src/Symfony/Bundle/SecurityBundle/Tests/DependencyInjection/CompleteConfigurationTest.php

+            'JMS\FooBundle\Entity\User7' => array(
+                'class' => 'Symfony\Component\Security\Core\Encoder\Argon2iPasswordEncoder',
+                'arguments' => array(),
+            ),


This is what breaks tests, as it runs on PHP 5.6. I suggest writing a dedicated test in SecurityExtensionTest, skipped if argon2i not supported.

I'm not quite sure how to implement that - will need more details or be pointed in the right direction if I'm to implement that by end of play tomorrow, sorry!

I did it for you in 51be4e5 :)

Awesome, thank you very much @chalasr! Looking at that commit, it would have taken me a long time to figure that out!

ogizanagi · 2017-09-28T13:31:33Z

src/Symfony/Component/Security/Core/Encoder/Argon2iPasswordEncoder.php

+        if (\PHP_VERSION_ID >= 70200 && \defined('PASSWORD_ARGON2I')) {
+            return !$this->isPasswordTooLong($raw) && password_verify($raw, $encoded);
+        }
+        if (function_exists('sodium_crypto_pwhash_str_verify')) {


Should be fully qualified too, considering PHP-CS-Fixer/PHP-CS-Fixer#3048 (comment) ?

indeed, it should

Sure, will fully-qualify those two functions too :)

ogizanagi · 2017-09-28T13:31:39Z

src/Symfony/Component/Security/Core/Encoder/Argon2iPasswordEncoder.php

+
+            return $valid;
+        }
+        if (extension_loaded('libsodium')) {


chalasr

All good

zanbaldwin · 2017-09-29T11:52:59Z

Should I squash my five commits?

chalasr · 2017-09-29T12:09:00Z

@zanbaldwin We can do it while merging, as you wish.
@stof requested changes have been made, is this ok for you?

nicolas-grekas · 2017-09-29T12:57:42Z

In fact yes, squashing is needed because we can't make it when several authors are in the history.

@chalasr

Add the Argon2i hashing algorithm provided by libsodium as a core encoder in the Security component, and enable it in the SecurityBundle. Credit to @chalasr for help with unit tests.

fabpot · 2017-09-29T14:04:18Z

Thank you @zanbaldwin.

This PR was merged into the 3.4 branch. Discussion ---------- [Security] Argon2i Password Encoder | Q | A | ------------- | --- | Branch? | master | Bug fix? | no | New feature? | yes | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | | License | MIT | Doc PR | WIP Since the [libsodium RFC](https://wiki.php.net/rfc/libsodium) passed with flying colours, I'd like to kick start a discussion about adding Argon2i as a password encoder to the security component. The initial code proposal in this PR supports both the upcoming public API confirmed for PHP 7.2, and the [libsodium PECL extension](https://pecl.php.net/package/libsodium) for those below 7.2 (available for PHP 5.4+). #### Concerns - Should the test cover hash length? At the moment the result of Argon2i is 96 characters, but because the hashing parameters are included in the result (`$argon2i$v=19$m=32768,t=4,p=1$...`) this is not guaranteed. - I've used one password encoder class because the result *should* be the same whether running natively in 7.2 or from the PECL extension, but should the logic be split out into separate private methods (like `Argon2iPasswordEncoder::encodePassword()`) or not (like in `Argon2iPasswordEncoder::isPasswordValid()`)? Since I can't really find anything concrete on Symfony choosing one way over another I'm assuming it's down to personal preference? #### The Future Whilst the libsodium RFC has been approved and the public API confirmed, there has been no confirmation of Argon2i becoming an official algorithm for `passhword_hash()`. If that is confirmed, then the implementation should *absolutely* use the native `password_*` functions since the `sodium_*` functions do not have an equivalent to the `password_needs_rehash()` function. Any feedback would be greatly appreciated 😃 Commits ------- be093dd Argon2i Password Encoder

Add/modify sections for the Argon2i password encoder (symfony/symfony#21604).

This PR was merged into the 3.4 branch. Discussion ---------- Argon2i Password Encoder | Q | A | | --- | --- | | Doc fix? | no | | New docs? | yes (symfony/symfony#21604) | | Applies to | `3.4` | | Fixed tickets | N/A | Add sections for the Argon2i password encoder. Commits ------- d96fda4 Removed a duplicated reference be4f85c Argon2i Password Encoder

carsonbot added Status: Needs Review Security Feature labels Feb 13, 2017

stof requested changes Feb 14, 2017

View reviewed changes

zanbaldwin changed the base branch from 2.8 to master February 14, 2017 11:56

nicolas-grekas added this to the 3.x milestone Feb 14, 2017

derrabus reviewed Feb 15, 2017

View reviewed changes

stof reviewed Feb 15, 2017

View reviewed changes

zanbaldwin mentioned this pull request Feb 15, 2017

[Security] Saltless Encoder Interface #21620

Merged

xabbuh reviewed Mar 13, 2017

View reviewed changes

sstok suggested changes Jun 18, 2017

View reviewed changes

xabbuh reviewed Sep 28, 2017

View reviewed changes

fabpot approved these changes Sep 28, 2017

View reviewed changes

stof requested changes Sep 28, 2017

View reviewed changes

chalasr reviewed Sep 28, 2017

View reviewed changes

ogizanagi reviewed Sep 28, 2017

View reviewed changes

carsonbot removed the Status: Needs Review label Sep 29, 2017

chalasr approved these changes Sep 29, 2017

View reviewed changes

carsonbot added the Status: Reviewed label Sep 29, 2017

Argon2i Password Encoder

be093dd

Add the Argon2i hashing algorithm provided by libsodium as a core encoder in the Security component, and enable it in the SecurityBundle. Credit to @chalasr for help with unit tests.

fabpot approved these changes Sep 29, 2017

View reviewed changes

fabpot merged commit be093dd into symfony:3.4 Sep 29, 2017

zanbaldwin deleted the 2.8-argon2i-encoder branch September 29, 2017 14:07

chalasr mentioned this pull request Oct 2, 2017

New argon2i password encoder symfony/symfony-docs#8441

Closed

zanbaldwin added a commit to zanbaldwin/symfony-docs that referenced this pull request Oct 4, 2017

Argon2i Password Encoder

26dc85c

Add/modify sections for the Argon2i password encoder (symfony/symfony#21604).

zanbaldwin mentioned this pull request Oct 4, 2017

Argon2i Password Encoder symfony/symfony-docs#8481

Merged

This was referenced Oct 18, 2017

Release v3.4.0-BETA1 #24609

Merged

Release v4.0.0-BETA1 #24612

Merged

zanbaldwin added a commit to zanbaldwin/symfony-docs that referenced this pull request Jan 5, 2018

Argon2i Password Encoder

be4f85c

Add/modify sections for the Argon2i password encoder (symfony/symfony#21604).

[Security] Argon2i Password Encoder #21604

[Security] Argon2i Password Encoder #21604

Conversation

zanbaldwin commented Feb 13, 2017 • edited Loading

Concerns

The Future

linaori commented Feb 14, 2017

zanbaldwin commented Feb 14, 2017

stof commented Feb 14, 2017

stof commented Feb 14, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

stof commented Feb 14, 2017

zanbaldwin commented Feb 14, 2017

stof commented Feb 14, 2017

stof commented Feb 14, 2017

zanbaldwin commented Feb 14, 2017

jedisct1 commented Feb 14, 2017 • edited Loading

derrabus Feb 15, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

zanbaldwin commented Mar 13, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nicolas-grekas commented Mar 22, 2017

zanbaldwin commented Mar 23, 2017 • edited Loading

sstok commented Jun 18, 2017

Choose a reason for hiding this comment

chalasr commented Sep 9, 2017 • edited Loading

zanbaldwin commented Sep 12, 2017 • edited Loading

chalasr commented Sep 14, 2017

nicolas-grekas commented Sep 26, 2017

zanbaldwin commented Sep 26, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

zanbaldwin commented Sep 28, 2017

xabbuh commented Sep 28, 2017

fabpot left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

zanbaldwin commented Sep 28, 2017

xabbuh commented Sep 28, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

chalasr left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

chalasr left a comment

Choose a reason for hiding this comment

zanbaldwin commented Sep 29, 2017

chalasr commented Sep 29, 2017

nicolas-grekas commented Sep 29, 2017

fabpot commented Sep 29, 2017

zanbaldwin commented Feb 13, 2017 •

edited

Loading

jedisct1 commented Feb 14, 2017 •

edited

Loading

derrabus Feb 15, 2017 •

edited

Loading

zanbaldwin commented Mar 23, 2017 •

edited

Loading

chalasr commented Sep 9, 2017 •

edited

Loading

zanbaldwin commented Sep 12, 2017 •

edited

Loading

xabbuh commented Sep 28, 2017 •

edited

Loading