question on defaults for argon2

[84adam]

Are the defaults for argon2 in pwdlib documented anywhere? I can't seem to find them in docs or source code.

from pwdlib import PasswordHash
password_hash = PasswordHash.recommended()
password_hash.hash("herminetincture")

example output structure: $argon2id$v=19$m=65536,t=3,p=4$<hashedpw>

^ from the above I assume version=19; memory=65536 kibibytes; iterations=3; parallelism=4. Is this correct?

[frankie567]

The defaults are actually pulled directly from Argon2 implementation:

pwdlib/pwdlib/hashers/argon2.py

Lines 15 to 23 in 17fd0c6

	def __init__(
	self,
	time_cost: int = argon2.DEFAULT_TIME_COST,
	memory_cost: int = argon2.DEFAULT_MEMORY_COST,
	parallelism: int = argon2.DEFAULT_PARALLELISM,
	hash_len: int = argon2.DEFAULT_HASH_LENGTH,
	salt_len: int = argon2.DEFAULT_RANDOM_SALT_LENGTH,
	type: argon2.Type = argon2.Type.ID,
	) -> None:

Which are defined there, and corresponds to the "low memory" profile of the RFC:

https://github.com/hynek/argon2-cffi/blob/0805dbdded04dc3c4bc8573236c80be50ff30113/src/argon2/profiles.py#L30-L38

[84adam]

Thanks! That's very helpful. Can you please help me with an example of how to initialize a PasswordHash object with a different time cost, e.g. 4 instead of 3? It was not clear to me how to do this exactly...

For example, do I just do: ph = PasswordHash(time_cost=4) ?

[frankie567]

Sure! PasswordHash is just a wrapper around algorithms: if you want to customize the parameters, you'll need to explicitly create an Argon2Hasher class and pass it down:

from pwdlib import PasswordHash
from pwdlib.hashers.argon2 import Argon2Hasher

password_hash = PasswordHash((
    Argon2Hasher(time_cost=4),
))

[84adam]

Excellent. Thanks so much!

[84adam]

for reference, I did some benchmarking on a couple 4-core VMs; it seems like a time_cost of around 25-27 was appropriate to target 250ms+ for time required to hash with argon2: https://gist.github.com/84adam/51b30ef4b8edd420f6f1d6ab6eea40fe