Any plan to create helper/wrapper to convert string to bytes and vice versa? about argon2-cffi HOT 4 CLOSED

By tricky you mean inconvenient I presume? :)

The situation is as following:

• The library works (as virtually any C library) on bytes. I can’t know what encoding your secrets are in (because it can be any byte, not just readable/printable ones). Trying to guess that in a security context like this, is a road to security vulnerabilities.
• hash_password_raw() also has to return bytes because it does. There’s no applicable encoding.

On the other hand, the encoded hash is always ASCII bytes, therefore I could easily encode/decode it.

But I’ve decided for the sake of:

1. simplicity/symmetry (any string is bytes, you don’t have to think about it),
2. performance (I still have to pass in bytes and I still get back bytes. if the user doesn't want unicode, there's an extra encoding/decoding round which puts you at a disadvantage to the attacker).

to keep it as bytes too.

As you can see, supporting Unicode would force me to make decisions for the users. In my other libraries I’m usually happy to do so (opinionated software tends to be better software), but this one is a) security-related and b) rather low-level since it’s the direct C-wrapper.

So, at this point we can decide to build higher-level helpers that presume that you always want your Unicode secrets interpreted as UTF-8 when going in and decoded when coming out. Maybe I’ll add something like that at some point, but for know I’d encourage you to build your own simple helpers (which also may contain your parameters?) until clearer usage patterns emerge.

I think I’ll start an FAQ with this. :)

from argon2-cffi.

Thanks for the explanation hynek! I really appreciate it.

from argon2-cffi.

Does http://argon2-cffi.readthedocs.org/en/latest/api.html#module-argon2 do what you need?

from argon2-cffi.

Yes!!! LOL
Thanks a lot!!

from argon2-cffi.