Comments (5)
I'm not sure I 100% understood, so just to double-check:
You'd like that the server sends the client a salt (presumably the salt that it added to its own password) and the client returns an argon2 hash with said salt and the server can just compare its own hash with the one the client sent? 🤔
from argon2-cffi.
No, I would like that the client will have a salt that is never shared with the server.
so the client won't have to send the actual password to the server, but will use a constant argon2 hash instead.
This is the flow I have in my mind
Client code:
def get_temporary_token_from_server(user_name, user_password):
ph = PasswordHasher(salt=os.environ.get("CLIENT_SALT")
argon2_hash = ph.hash(user_password)
token_from_server = server.get_token(user_name=user_name, password_hash=argon2_hash)
Server code:
def verify_password_hash(user_name, hash_from_client):
user = get_user(user_name) # In the DB we store for each user argon2_hash and a unique random salt)
user_hash_to_verify = concat(hash_from_client + user.user_salt)
ph = PasswordHasher()
# here we verify that the user.password_hash is a valid argon2 hash for user_hash_to_verify which is a constant string we can create by concating the constant argon2_hash sent via the client and the salt kept for this user in the server DB
ph.verify(user.password_hash, user_hash_to_verify)
- the client will use a constant salt stored securely and unavailable to the server (this salt should be generated with secure random function)
- client salt is not being sent to the server
- the server will never know the user actual password
- the server may keep a salt for each user that the client isn't aware of.
from argon2-cffi.
I presume #153 would fix your problem?
from argon2-cffi.
yes, thanks 👍
from argon2-cffi.
23.1.0 is on PyPI
from argon2-cffi.
Related Issues (20)
- RFC is no longer a draft (RFC9106); default parameter choice out of date HOT 4
- 21.2.0: pep517 does not build cython modules HOT 6
- 21.1.0: `notebook` test suite is crashing with SIGILL in _cffi_backend.cpython.*so DSO HOT 11
- Inconsistent advice for key derivation HOT 5
- How to avoid timing attacks? HOT 1
- hash function return + / verify issue with sqlite HOT 3
- Question: Can output from argon2.low_level.hash_secret_raw() → bytes directly used to derive aes key? HOT 3
- Associated data cannot be specified in the low_level functions HOT 10
- Make hash verification return True or False HOT 4
- Second salt HOT 1
- hash() got an unexpected keyword argument 'salt' HOT 1
- ImportError: cannot import name 'PasswordHasher' from partially initialized module 'argon2' HOT 1
- Install with poetry on python 3.11.7 --obsolete
- Strange error, can't figure out what is causing it HOT 2
- Make PasswordHasher.check_needs_rehash() accept bytes hash
- Allow use of argon2 "secret" parameter for keyed hashing HOT 1
- Fail to install by pip on macOS 11.0.1 Big Sur HOT 11
- 20.1.0: sphinx warnings HOT 4
- 20.1.0: pytest warnings HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from argon2-cffi.