[6.x] Update the default Argon2 options #5788
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I noticed 2 problems with the default Argon2 options.
Argon2 options may be dated
When first introduced, the indicated values for memory cost, time cost and threads for Argon2 hashing was the same as defined in their PHP constant counterparts. However, they have since been updated in PHP bug #78269, where the old defaults are called "weak".
New values are as follows:
Argon2 threads option is lowered further on RHEL
A second issue arises when using the old values on PHP supplied from Remi's RPM repository, e.g. on RHEL. For creating new hashes, PHP here relies on libsodium (on PHP version 7.4 onwards), which does not support a thread value > 1.
As a result, the threads options is lowered from 2 to 1 when generating a new password hash in Laravel 6.
This may not affect a lot of people, but updating the Argon2 options to the values now used by PHP can easily fix this. It would also bring Laravel's Argon2 options back in line with PHP's.
Site admins may then want to check if they have stored any password hashes affected by this and have to decide whether or not to reset the users' passwords.