appwrite
appwrite copied to clipboard
Password Hashing algos
What does this PR do?
Appwrite uses bcrypt encryption. This PR adds support for more algorithms. This PR will make it possible to use multiple algorithms under the hood, making user migration into Appwrite way more accessible.
Hashing algo switched to Argon2. Looks to be more secure than BCrypt, so let's be the safest baas 😎 Thanks to this PR, projects using old algo will still work.
Test Plan
All current tests should pass. New tests implemented.
Related PRs and Issues
- https://github.com/appwrite/appwrite/issues/2709
- https://github.com/appwrite/appwrite/issues/2710
Have you read the Contributing Guidelines on issues?
✅
I have done research about hashing to full understand the problem.
- Cost. Appwrite uses 8, others seems to use 10
- Version (A or B, X, Y), B used widely
- Salt can be provided, instead of random generation
- No configuration. Not secure, should not be allowed for registration (only for import)
- Complex as hell, more research needed
SCrypt (Google fork)
- Complex as hell, most likely also more secure
- Seems to be the simple one, and the secure one
- Used by many established PHP projects
- Like MD5 - not good (for passwords), but some projects still use it. Has many versions