spring-projects / spring-projects/spring-security
Update Argon2PasswordEncoder defaults to match OWASP Recommendations for 2023.
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Expected Behavior
Argon2PasswordEncoder should have defaults that match OWASP Cheat Cheat Recommendations.
Current Behavior
Current behavior is close but the cheat cheat has been updated from
15 MiB to 19 MiB of memory. This based on the memory bandwidth of modern GPUs as explained in the comment on the pull request from @Sc00bz linked above.
Context
Was evaluating Spring Security's defaults against OWASP's Cheat Sheet Recommendations for Argon2 usage. It seems that you made a similar update in 2022 via gh-10506.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the Argon2PasswordEncoder implementation and inspect its default parameters against the linked OWASP guidance. Update the default memory setting to the cited 19 MiB recommendation, then verify the existing Spring Security tests and default behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- security
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100