Possible to remove hard-coded upper limit on t_cost? about ruby-argon2 HOT 4 CLOSED

@dgpokl In terms of best practice, the official paper has a "recommended parameters" section here:

https://github.com/P-H-C/phc-winner-argon2/blob/master/argon2-specs.pdf

Unfortunately it doesn't suggest a reasonable timeframe, but asks you to identify one. So you may feel one second is fine.

Most top Google hits for bcrypt recommendations suggest 0.1s to 0.3s.

from ruby-argon2.

Most people would consider a one second hash time a DoS attack. This library was built with overly "safe" values to prevent someone doing something silly.

This had, at a root cause, a highly aggressive email I receive from someone who DoS'ed themselves with a similar library I wrote.

If much higher values of t_cost suit your needs and use case, I'll raise the limitation. This will be released shortly.

from ruby-argon2.

I've pushed a fix. You'll probably appreciate a release, I'll do one tonight.

from ruby-argon2.

Thanks for the words of caution and also for the responsiveness. I may reconsider. Overall, just trying to follow best practices here and don't want the 'cure' to be worse than the disease.

from ruby-argon2.