ddn.crypto.hash.argon2

Argon2 Password Hashing Scheme (RFC 9106).

enum Argon2Type

struct Argon2AddressGen

class Argon2Digest

fn argon2 blake2bLong compressBlock compressBlockXor computeReference fillBlockWithHash G_argon permute

Types 3

enumArgon2Type

Argon2 Variant.

ARGON2D = 0Argon2d: data-dependent addressing (side-channel exposed).

ARGON2I = 1Argon2i: data-independent addressing (password hashing).

ARGON2ID = 2Argon2id: hybrid - independent addressing for the first half of the first pass, dependent afterwards.

classArgon2Digest : Hash

Argon2 Digest Wrapper implementing Hash interface.

This class adapts the Argon2 PHS to the generic Hash interface. The input data fed via update is treated as the password. Salt and other parameters must be provided at construction.

Note

Argon2 requires the length of the password to be known at the start of the hashing process.

Therefore, this implementation buffers the entire input provided via update calls until finish is called. This may consume significant memory for very large inputs.

Fields

private Argon2Type _type

private int _version

private uint _t

private ubyte[] _salt

private ubyte[] _secret

private ubyte[] _ad

private uint _tagLength

private Appender!(ubyte[]) _buffer

Methods

Hash update(const(ubyte)[] input)

ubyte[] finish()

void reset()

void wipe() nothrow @nogc @trustedZeroizes all secret inputs retained by this digest (the password buffer, salt, secret, and associated data).

size_t blockSize() @property const

size_t size() @property const

Constructors

this(Argon2Type type,  uint  t,  uint  m,  uint  p,  const(ubyte)[]  salt,  uint  tagLength =  32,
          const(ubyte)[]  secret =  null,  const(ubyte)[]  ad =  null,  int  version_ =  0x13)

private structArgon2AddressGen

Data-independent address generator for Argon2i and Argon2id (RFC 9106 Section 3.4.1.2).

For each segment it produces a stream of pseudo-random 64-bit words: counter values i = 1, 2, ... each yield the 1024-byte block G(ZERO, G(ZERO, Z || LE64(i) || ZERO(968))), where Z is LE64(r) || LE64(l) || LE64(sl) || LE64(m') || LE64(t) || LE64(y); the 128 words of each block are consumed in order, one word per reference-block computation, with J1/J2 taken from the low/high 32 bits of the word.

Fields

private ulong[128] input

private ulong[128] addrBlock

private uint covered

Methods

ulong word(uint indexInSegment)Returns the pseudo-random word for the given index within the segment, regenerating the address block whenever a new 128-word block is needed (indices are requested in increasing order).

Constructors

this(uint  pass,  uint  lane,  uint  slice,  uint  mPrime,  uint  t,
          Argon2Type type)

Params: pass = Current pass number r. lane = Current lane number l. slice = Current slice number sl. mPrime = Total number of memory blocks m'. t = Total number of passes. type = The Argon2 type y.

Functions 8

ubyte[] argon2(Argon2Type type,  int  version_,  uint  t,  uint  m,  uint  p,
       const(ubyte)[]  pwd,  const(ubyte)[]  salt,
       const(ubyte)[]  secret,  const(ubyte)[]  ad,  uint  tagLength)

Argon2 Core Function.

private fnvoid fillBlockWithHash(ulong[] block, const(ubyte)[] input, size_t outLen)

private fnubyte[] blake2bLong(const(ubyte)[] input, uint outLen)Computes the variable-length hash function H' of RFC 9106 Section 3.3. For `outLen` <= 64, the result is `BLAKE2b-outLen(LE32(outLen) || input)`. For larger outputs, let `r = ceil(outLen/32) - 2`; ...

private fn

uint computeReference(ulong  j1,  ulong  j2,  uint  pass,  uint  slice,  uint  index,  uint  segmentLength,  uint  laneLength,  uint  l,  uint  refLane)

private fnvoid permute(ref ulong[128] v)

private fnvoid compressBlockXor(ulong[] prev, ulong[] refB, ulong[] curr)

private fnvoid compressBlock(ulong[] prev, ulong[] refB, ulong[] curr)

private fnvoid G_argon(ref ulong[128] v, int a, int b, int c, int d)