Skip to content
Snippets Groups Projects
  1. Feb 13, 2022
    • Julian's avatar
      Argon2 for user password hashing · ac003909
      Julian authored
      Argon2 is a modern password hashing algorithm. It is significantly more secure
      than the previous algorithm (salted SHA512). User logins with Argon2 are
      relativly slow and cause significant spikes in CPU and memory (100MB) usage.
      
      Existing passwords are gradually migrated to Argon2 on login.
      ac003909
    • Julian's avatar
      Unified password hashing for User and Signup · 117e257c
      Julian authored
      Previously User used salted SHA512 with OpenLDAP-style prefix syntax and
      Signup used crypt. Both models had their own hashing and verification
      code. Now both use OpenLDAP-style syntax with support for all traditional
      formats including crypt. Salted SHA512 is used for new User and Signup
      passwords.
      
      Existing Signup objects are migrated to the new format and remain functional.
      User passwords now support gradual migration to another hash algorithm when
      it is changed in the future.
      
      This code is planned to be used for database-stored API and OAuth2 client
      secrets.
      117e257c
Loading