You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
allowing the user to configure things like the encryption algorithm and Argon2 parameters is a weakness rather than a strength of the application. That's why most encryption programs aren't configurable
[...] allowing the user to configure things like the encryption algorithm and Argon2 parameters is a weakness rather than a strength of the application [...]
Indeed, but it also depends on the context.
Thus, to put things into perspective: z-tokens is an umbrella project for various password, hash, and encryption tools; one of these tools is z-tokens hash that serves as a one-stop-shop for data hashing, from CRC, non-cryptographic hashes (such as Xxh3), through MD5 (and other currently unsafe algorithms), to Blake3 and SHA-3, and finally to Scrypt or Argon2 that if you squint hard enough look like hashes.
Thus, if one uses the z-tokens hash tool, one is well aware of what one wants to achieve, thus exporting various low-level features (like stating the seed for various hashes, or the parameters for Scrypt or Argon2) helps when needed.
Where would one use this tool? Mainly in bash scripts to quickly prototype stuff, or when trying to be compliant with other implementations. Thus "security" isn't quite on the top of the list at this stage.
Moreover, if one needs Argon2 to hash some password into some cryptographic key, there is the z-tokens exchange password tool that does what you suggest (i.e. providing hard-coded parameters for the various algorithms, including Argon2).
No description provided.
The text was updated successfully, but these errors were encountered: