<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Good morning all,<div dir="auto"><br></div><div dir="auto">Following James’ announcement of Jelly, I thought I’d share a new gem I released yesterday for your feedback: <div><a href="https://github.com/mudge/argon2id">https://github.com/mudge/argon2id</a></div><div><br></div></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;"><div dir="auto"><div><div><font face="Courier New">Argon2::Password.create("opensesame").to_s</font></div></div></div><div dir="auto"><div><div><font face="Courier New">#=> "$argon2id$v=19$m=19456,t=2,p=1$ZS2nBFWBpnt28HjtzNOW4w$SQ+p+dIcWbpzWpZQ/ZZFj8IQkyhYZf127U4QdkRmKFU"</font></div></div></div><div dir="auto"><div><div><font face="Courier New"><br></font></div></div></div><div dir="auto"><div><div><font face="Courier New">Argon2::Password.create("opensesame") == "opensesame"</font></div></div></div><div dir="auto"><div><div><font face="Courier New">#=> true</font></div></div></div><div dir="auto"><div><div><font face="Courier New"><br></font></div></div></div><div dir="auto"><div><div><font face="Courier New">Argon2::Password.new("$argon2id$v=19$m=19456,t=2,p=1$ZS2nBFWBpnt28HjtzNOW4w$SQ+p+dIcWbpzWpZQ/ZZFj8IQkyhYZf127U4QdkRmKFU") == "opensesame"</font></div></div></div><div dir="auto"><div><div><font face="Courier New">#=> true</font></div></div></div></blockquote><div dir="auto"><div dir="auto"><br></div><div dir="auto">Argon2id provides Ruby bindings to the reference C implementation of Argon2, the password-hashing function that won the 2015 Password Hashing Competition and is currently recommended by the OWASP Password Storage Cheat Sheet (<a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#argon2id">https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#argon2id</a>). It has no runtime dependencies and native, precompiled versions of the gem are available for Linux, macOS and Windows.<div dir="auto"><br></div><div dir="auto">This came about because I read Pilcrow’s The Copenhagen Book which recommends Argon2id for password storage (<a href="https://thecopenhagenbook.com/password-authentication#argon2id">https://thecopenhagenbook.com/password-authentication#argon2id</a>) but I was used to bcrypt-ruby (most commonly via Rails’ has_secure_password) and Coda Hale’s mantra of “Use bcrypt” from <div dir="auto"><a href="https://codahale.com/how-to-safely-store-a-password/">https://codahale.com/how-to-safely-store-a-password/</a>. There are existing gems that use FFI bindings to Argon2 but I was keen to see if I could put my experience shipping native gems from my work on re2 (<a href="https://github.com/mudge/re2">https://github.com/mudge/re2</a>) to good use and ship a small gem with no dependencies.</div><div dir="auto"><br></div><div dir="auto">Where possible, I try to keep the API familiar to users of BCrypt::Password with Argon2id::Password.create for hashing passwords using recommended defaults, Argon2id::Password.new for wrapping an existing hash and Argon2id::Password#== (aliased to Argon2id::Password#is_password?) for verifying hashes against plain text passwords. You can see more at <a href="https://github.com/mudge/argon2id?tab=readme-ov-file#usage">https://github.com/mudge/argon2id?tab=readme-ov-file#usage</a></div></div><div dir="auto"><br></div><div dir="auto">Please give it a whirl, let me know what you think, and feel free to report any issues at <a href="https://github.com/mudge/argon2id/issues">https://github.com/mudge/argon2id/issues</a></div></div></div><br><div>
<div>Kind regards,</div><div><br></div><div>-- Paul</div>
</div>
<br></body></html>