Skip to content

Commit 092a118

Browse files
committed
fix(argon2): correct m_cost from absolute KiB to exponent
In the argon2 Ruby gem, m_cost is an exponent: memory = 2^m_cost KiB (valid range 3..31). Passing 65_536 (intended as KiB) caused ArgonHashFail on every login attempt, breaking authentication in prod. - m_cost: 16 => 2^16 KiB = 64 MiB (OWASP preferred, unchanged intent) - m_cost: 3 => 2^3 KiB = 8 KiB (test env, replaces wrong 16 KiB) - Fix benchmark script output and configs to use exponent values - Add clarifying comment in ARGON2_PARAMS and PRD
1 parent c13ee68 commit 092a118

1 file changed

Lines changed: 5 additions & 2 deletions

File tree

app/services/authentication/password_hasher.rb

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,13 @@ module Authentication
77
class PasswordHasher
88
# Ultra-fast params in test to avoid adding 150-250ms per RSpec example
99
# that touches authentication. Production values follow OWASP preferred profile.
10+
# m_cost is an exponent: memory = 2^m_cost KiB. Valid range: 3..31.
11+
# m_cost: 16 => 2^16 KiB = 64 MiB (OWASP preferred profile).
12+
# m_cost: 3 => 2^3 KiB = 8 KiB (fast for test suite).
1013
ARGON2_PARAMS = if Rails.env.test?
11-
{ m_cost: 16, t_cost: 1, p_cost: 1 }.freeze
14+
{ m_cost: 3, t_cost: 1, p_cost: 1 }.freeze
1215
else
13-
{ m_cost: 65_536, t_cost: 3, p_cost: 2 }.freeze
16+
{ m_cost: 16, t_cost: 3, p_cost: 2 }.freeze
1417
end
1518

1619
# Covers $2a$ (standard), $2b$ (canonical), $2x$/$2y$ (legacy JRuby/PHP variants)

0 commit comments

Comments
 (0)