imkcat / catcrypto Goto Github PK

Issue type

• Bug
• Feature
• Question

Desciption

Hello,

first of all, thank you for your OS contribution by providing this library. I am currently considering a few options to add argon2 support to one of my react native projects and was wondering CatCrypto is still maintained? Seeing that this is a very important and security relevant project I want to get the project right from the beginning. I would really like to use CatCrypto but before I go ahead I wanted to confirm that this project is still actively maintained and reactive to CVE's etc.

Thank you!

Issue type

• Bug
• Feature
• Question

Environment

• CatCrypto: 0.3.2
• Xcode: 12.1
• iOS: 14.1

Description

Currently using CatCrypto for my downstream library, react-native-argon2 and this is a replacement for the SignalApp library as that has a GPL license and I would like to keep my package as MIT. Hence I chose your library. However I seem to be getting an incorrect hexadecimal value from the output of the Argon2 hashing. The string representation is correct however the hexadecimal value doesn't seem to be right.

Reproduce steps

Password: password
Salt: 1234567891011121314151617181920212223242526272829303132333435363

Code:

    let argon2Context = CatArgon2Context.init();
    argon2Context.iterations = 2;
    argon2Context.memory = 32 * 1024;
    argon2Context.parallelism = 1;
    argon2Context.salt = salt;
    argon2Context.hashLength = 32;
    argon2Context.mode = .argon2id;

    let argon2Crypto = CatArgon2Crypto.init(context: argon2Context);
    let result = argon2Crypto.hash(password: password);

    if ((result.error) != nil) {
        let error = NSError(domain: "com.poowf.argon2", code: 200, userInfo: ["Error reason": "Failed to generate argon2 hash"])
        reject("E_ARGON2", "Failed to generate argon2 hash", error)
    }

    let rawHash = result.hexStringValue();
    let encodedHash = result.stringValue();

    let resultDictionary: NSDictionary = [
        "rawHash" : rawHash,
        "encodedHash" : encodedHash,
    ]

Expected:
Hexadecimal value: 031d6c82ddede1200f4794605052745dd562bd4db358e23dac1b11c052eff8d9
String value: $argon2id$v=19$m=32768,t=2,p=1$MTIzNDU2Nzg5MTAxMTEyMTMxNDE1MTYxNzE4MTkyMDIxMjIyMzI0MjUyNjI3MjgyOTMwMzEzMjMzMzQzNTM2Mw$Ax1sgt3t4SAPR5RgUFJ0XdVivU2zWOI9rBsRwFLv+Nk

Received:
Hexadecimal value: 246172676f6e32696424763d3139246d3d33323736382c743d322c703d31244d54497a4e4455324e7a67354d5441784d5445794d544d784e4445314d5459784e7a45344d546b794d4449784d6a49794d7a49304d6a55794e6a49334d6a67794f544d774d7a457a4d6a4d7a4d7a517a4e544d324d77244178317367743374345341505235526755464a30586456697655327a574f49397242735277464c762b4e6b00
String value: $argon2id$v=19$m=32768,t=2,p=1$MTIzNDU2Nzg5MTAxMTEyMTMxNDE1MTYxNzE4MTkyMDIxMjIyMzI0MjUyNjI3MjgyOTMwMzEzMjMzMzQzNTM2Mw$Ax1sgt3t4SAPR5RgUFJ0XdVivU2zWOI9rBsRwFLv+Nk

This sounds like a crazy thing to ask for, but it would be nice to have a cryptographic hash that has a lower chance of collusion, such as RadioGatún. I don't know any others that would go up to to 1216 bits, even though the security of it has been questioned somewhat.

I use the CatArgon2Crypto with this code,
let argon2Crypto = CatArgon2Crypto()
argon2Crypto.context.mode = .argon2id
argon2Crypto.context.salt = "5E844EE4D2E26920F8B0C4B784692905"
argon2Crypto.context.parallelism = 1
argon2Crypto.context.memory = 14
argon2Crypto.context.iterations = 1
let result = argon2Crypto.hash(password: password)
And I get the result string:
$argon2id$v=19$m=14,t=1,p=1$NUU4NDRFRTREMkUyNjkyMEY4QjBDNEI3ODQ2OTI5MDU$RJedQCuhWywUpZ9PUnu5+KbzHBQZ5UgvPr6SOYuPTgg\0
How can I get the hash string? Like this:
EE0A64A2438896F6B825DD25A655B88EFE05CC5847D1FC0826E9B2E58AA248EB

Environment

• CatCrypto: 0.3.0
• Xcode: 11.0 beta 5
• iOS: 13.0 beta 6

Reproduce steps

1. Build a project.

Description

Swift Compiler Error:

• Redefinition of module 'CommonCrypto' (iPhoneSimulator13.0.sdk/usr/include/CommonCrypto/module.modulemap:1:8)
• Could not build Objective-C module 'CommonCryptoFramework' (CatCrypto/Sources/Core/Crypto.swift:23:8)

Issue type

• [X ] Bug
• [X ] Feature
• Question

Issue type

• Bug
• Feature
• Question

Before question

• Reading usage section and API Reference
• Searched in issues to find duplicated or related issues

Desciption

After updating to 0.3.0 I noticed null char at the end of result string when using Argon2 hash function.

i.e.
Even when checking CatCrypto tests (ArgonTests.swift) I expect to get

"$argon2i$v=19$m=4096,t=3,p=1$ODExM0FENzYtQjFENC00NzE0LUE1NjktQTkyMDMzNkYzRkI3$wJfIvpKfuE91unyYNwEfLyuaXhWS9XuTJOGaFbP7wOE"

and I get this instead:

"$argon2i$v=19$m=4096,t=3,p=1$ODExM0FENzYtQjFENC00NzE0LUE1NjktQTkyMDMzNkYzRkI3$wJfIvpKfuE91unyYNwEfLyuaXhWS9XuTJOGaFbP7wOE\0"

Is that expected behaviour?