argon2-hashing alternatives and similar packages
Based on the "Security" category.
Alternatively, view argon2-hashing alternatives based on common mentions on social networks and blogs.
-
Lean and Mean Docker containers
DockerSlim (docker-slim): Optimize and secure your Docker containers -
lego
Pure Go ACME client library and CLI tool (for use with Let's Encrypt) -
autocert
Auto provision Let's Encrypt certificates and start a TLS server. -
Cameradar
Tool and library to remotely hack RTSP streams from surveillance cameras. -
acmetool
ACME (Let's Encrypt) client tool with automatic renewal. -
memguard
Secure software enclave for storage of sensitive information in memory. -
secure
HTTP middleware for Go that facilitates some quick security wins. -
Themis by Cossack Labs
Crypto library for storage and messaging for Swift, ObjC, Android, С++, JS, Python, Ruby, PHP, Go -
acra
Network encryption proxy to protect database-based applications from data leaks: strong selective encryption, SQL injections prevention, intrusion detection system. -
ToRat
ToRat is a Remote Administation tool written in Go using Tor as a transport mechanism and RPC for communication -
go-yara
Go Bindings for YARA, the "pattern matching swiss knife for malware researchers (and everyone else)" -
BadActor
An in-memory, application-driven jailer built in the spirit of fail2ban -
firewalld-rest
A rest application to dynamically update firewalld rules on a linux server. -
go-password-validator
Password validator based on raw cryptographic entropy values. -
simple-scrypt
an scrypt package with a simple, obvious API and automatic cost calibration built-in. -
argon2pw
Argon2 password hash generation with constant-time password comparison. -
goSecretBoxPassword
A probably paranoid package for securely hashing and encrypting passwords. -
Credman
A simple, powerful, cross-platform and military grade secure credential management. -
goArgonPass
Argon2 password hash and verification designed to be compatible with existing Python and PHP implementations. -
go-generate-password
Password generator that can be used on the cli or as a library. -
certificates
An opinionated tool for generating tls certificates. -
secureio
An keyexchanging+authenticating+encrypting wrapper and multiplexer for io.ReadWriteCloser based on XChaCha20-poly1305, ECDH and ED25519. -
sslmgr
SSL certificates made easy with a high level wrapper around acme/autocert. -
Go random string generator
Flexible and customizable random string generator -
Interpol
Rule-based data generator for fuzzing and penetration testing.
Scout APM - Leading-edge performance monitoring starting at $39/month
* Code Quality Rankings and insights are calculated and provided by Lumnify.
They vary from L1 to L5 with "L5" being the highest. Visit our partner's website for more details.
Do you think we are missing an alternative of argon2-hashing or a related project?
README
argon2-hashing
argon2-hashing provides a light wrapper around Go's argon2 package. Argon2 was the winner of the Password Hashing Competition that makes it easier to securely derive strong keys from weak inputs (i.e. user passwords).
With this library you can:
- Generate a argon2 derived key with a crytographically secure salt and default parameters.
- Tune argon2 with you own parameters based of you hardware configuration.
- Compare a derived key with the possible cleartext equivalent (user password).
Currently supported only Argon2id function.
The API closely mirrors with Go's Bcrypt library and Alex Edwards simple-scrypt package.
Installation
With a Go modules:
go get -u github.com/andskur/argon2-hashing
Example
argon2-hashing doesn't try to re-invent the wheel or do anything "special". It
wraps the argon2.IDKey
function as thinly as possible, generates a
crytographically secure salt for you using Go's crypto/rand
package, and
returns the derived key with the parameters prepended:
package main
import(
"fmt"
"log"
"github.com/andskur/argon2-hashing"
)
func main() {
// e.g. r.PostFormValue("password")
passwordFromForm := "qwerty123"
// Generates a derived key with default params
hash, err := argon2.GenerateFromPassword([]byte(passwordFromForm), argon2.DefaultParams)
if err != nil {
log.Fatal(err)
}
// Print the derived key.
fmt.Printf("%s\n", hash)
// Uses the parameters from the existing derived key. Return an error if they don't match.
err = argon2.CompareHashAndPassword(hash, []byte(passwordFromForm))
if err != nil {
log.Fatal(err)
}
}
Argon2 introduction
The Argon2 algorithm accepts a number of configurable parameters:
- Memory — The amount of memory used by the algorithm (in kibibytes).
- Iterations — The number of iterations (or passes) over the memory.
- Parallelism — The number of threads (or lanes) used by the algorithm.
- Salt length — Length of the random salt. 16 bytes is recommended for password hashing.
- Key length — Length of the generated key (or password hash). 16 bytes or more is recommended.
- The memory and iterations parameters control the computational cost of hashing the password. The higher these figures are, the greater the cost of generating the hash. It also follows that the greater the cost will be for any attacker trying to guess the password.
But there's a balance that you need to strike. As you increase the cost, the time taken to generate the hash also increases. If you're generating the hash in response to a user action (like signing up or logging in to a website) then you probably want to keep the runtime to less than 500ms to avoid a negative user experience.
If the Argon2 algorithm is running on a machine with multiple cores, then one way to decrease the runtime without reducing the cost is to increase the parallelism parameter. This controls the number of threads that the work is spread across. There's an important thing to note here though: changing the value of the parallelism parameter changes the output of the algorithm. So — for example — running Argon2 with a parallelism parameter of 2 will result in a different password hash to running it with a parallelism parameter of 4.
Choosing Parameters
Picking the right parameters for Argon2 depends heavily on the machine that the algorithm is running on, and you'll probably need to do some experimentation in order to set them appropriately.
The recommended process for choosing the parameters can be paraphrased as follows:
- Set the parallelism and memory parameters to the largest amount you are willing to afford, bearing in mind that you probably don't want to max these out completely unless your machine is dedicated to password hashing.
- Increase the number of iterations until you reach your maximum runtime limit (for example, 500ms).
- If you're already exceeding the your maximum runtime limit with the number of iterations = 1, then you should reduce the memory parameter.
Thanks to
- Alex Edwards - For an excellent article, after which I was inspired to develop this package.
- Matt Silverlock - For an great and well documented simple-scrypt package which I took for the structural basis.
Authors
- Andrey Skurlatov - andskur
License
This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details
*Note that all licence references and agreements mentioned in the argon2-hashing README section above
are relevant to that project's source code only.