diff options
| author |   JoshyPHP <s9e.dev@gmail.com> | 2020-01-28 01:41:54 +0100 |
|---|---|---|
| committer | JoshyPHP <s9e.dev@gmail.com> | 2020-01-28 01:42:39 +0100 |
| commit | 2dbcad78405031ba6ad90670f03d49cb5bbe16ea (patch) | |
| tree | db681a01f2a8d331734cc9d721148ead6f35b017 | |
| parent | Merge pull request #5825 from AlfredoRamos/ticket/16313 (diff) | |
| download | phpbb-2dbcad78405031ba6ad90670f03d49cb5bbe16ea.tar.gz phpbb-2dbcad78405031ba6ad90670f03d49cb5bbe16ea.tar.bz2 phpbb-2dbcad78405031ba6ad90670f03d49cb5bbe16ea.zip | |
[ticket/16342] Increase default hashing costs for Argon2 passwords
PHPBB3-16342
| -rw-r--r-- | phpBB/config/default/container/services_password.yml | 4 | ||||
| -rw-r--r-- | phpBB/phpbb/passwords/driver/argon2i.php | 6 | ||||
| -rw-r--r-- | tests/passwords/drivers_test.php | 4 |
3 files changed, 7 insertions, 7 deletions
diff --git a/phpBB/config/default/container/services_password.yml b/phpBB/config/default/container/services_password.yml index a9adbebfd7..38f7404330 100644 --- a/phpBB/config/default/container/services_password.yml +++ b/phpBB/config/default/container/services_password.yml @@ -1,7 +1,7 @@ parameters: - passwords.driver.argon2_memory_cost: 1024 + passwords.driver.argon2_memory_cost: 65536 passwords.driver.argon2_threads: 2 - passwords.driver.argon2_time_cost: 2 + passwords.driver.argon2_time_cost: 4 passwords.driver.bcrypt_cost: 10 services: diff --git a/phpBB/phpbb/passwords/driver/argon2i.php b/phpBB/phpbb/passwords/driver/argon2i.php index 03368f6361..3150eadfdd 100644 --- a/phpBB/phpbb/passwords/driver/argon2i.php +++ b/phpBB/phpbb/passwords/driver/argon2i.php @@ -33,7 +33,7 @@ class argon2i extends base_native * @param int $threads Number of threads to use (optional) * @param int $time_cost Maximum amount of time (optional) */ - public function __construct(\phpbb\config\config $config, helper $helper, $memory_cost = 1024, $threads = 2, $time_cost = 2) + public function __construct(\phpbb\config\config $config, helper $helper, $memory_cost = 65536, $threads = 2, $time_cost = 4) { parent::__construct($config, $helper); @@ -42,8 +42,8 @@ class argon2i extends base_native * See https://wiki.php.net/rfc/sodium.argon.hash and PHPBB3-16266 * Don't allow cost factors to be below default settings where possible */ - $this->memory_cost = max($memory_cost, defined('PASSWORD_ARGON2_DEFAULT_MEMORY_COST') ? PASSWORD_ARGON2_DEFAULT_MEMORY_COST : 1024); - $this->time_cost = max($time_cost, defined('PASSWORD_ARGON2_DEFAULT_TIME_COST') ? PASSWORD_ARGON2_DEFAULT_TIME_COST : 2); + $this->memory_cost = max($memory_cost, defined('PASSWORD_ARGON2_DEFAULT_MEMORY_COST') ? PASSWORD_ARGON2_DEFAULT_MEMORY_COST : 65536); + $this->time_cost = max($time_cost, defined('PASSWORD_ARGON2_DEFAULT_TIME_COST') ? PASSWORD_ARGON2_DEFAULT_TIME_COST : 4); $this->threads = (defined('PASSWORD_ARGON2_PROVIDER') && PASSWORD_ARGON2_PROVIDER == 'sodium') ? PASSWORD_ARGON2_DEFAULT_THREADS : max($threads, defined('PASSWORD_ARGON2_DEFAULT_THREADS') ? PASSWORD_ARGON2_DEFAULT_THREADS : 1); } diff --git a/tests/passwords/drivers_test.php b/tests/passwords/drivers_test.php index fc11ca0bc7..37b333e23a 100644 --- a/tests/passwords/drivers_test.php +++ b/tests/passwords/drivers_test.php @@ -24,8 +24,8 @@ class phpbb_passwords_helper_test extends \phpbb_test_case // Initialize argon2 default options $this->argon2_default_cost_options = [ - 'memory_cost' => 1024, - 'time_cost' => 2, + 'memory_cost' => 65536, + 'time_cost' => 4, 'threads' => 2 ]; |