Hash in .Net and Verify in node.js about node-argon2 HOT 6 CLOSED

Thanks, @ranisalt.
We have been debugging this for 2 days and we didn't pay attention toward this small typo. Anyway thanks again for helping us out. :-)

from node-argon2.

What library are you using to hash in .NET? Ideally, the generated hash already contains the salt and is in base64 so you shouldn't need this step. If you are using Konscious.Security.Cryptography with the recommended usage, just plug the generated hash to the verify function of node-argon2 and it will return either true or false.

from node-argon2.

We are using 'Konscious.Security.Cryptography.Argon2'. Now we are able to verify the password(hashed in .Net) in node.js using node-argon2. Not problem is other way. When we hash from node.js and try to verify in .Net, it doesn't work.

from node-argon2.

I found kmaragon/Konscious.Security.Cryptography#21 and it seems the author did not include a verify function that you can use. The reason seems incorrect: it is not more or less secure to include the parameters in the hash, and it is not useful to distribute the parameters to trusted parties.

We use the PHC string format as recommended, which means encoded hashes have the following format:

$argon2id$v=19$m=65536,t=3,p=4$c2FsdHNhbHRzYWx0c2FsdA$rBWULD5jOGpQy32rLvGcmvQMVqIVNAmrCtekWvUA8bw

That is

$<function>$<params>$<salt, base64 encoded>$<hash, base64 encoded>

So what you can do from your side is split on the $ character to get the parts of the encoded hash, pass it to the Hash function from Konscious.Security.Cryptography.Argon2 and then compare the resulting hash, since the same parameters result in the same hash always.

Let me know if you need more help. I also suggest opening an issue upstream at kmaragon/Konscious.Security.Cryptography to request a verify function to be implemented, as it improves developer experience.

from node-argon2.

Thanks for your reply, @ranisalt.

It seems like 'same parameters result in the same has always' is true for that language. I can see that .Net generates different hash than node.js with same parameters.

I am attaching the node.js and .Net sample applications showing the same. Please have a look at them.
Also see the below output screenshots:

.Net:

Node.js:

Nodejs.zip
.Net.zip

from node-argon2.

You likely have a typo in your code. I can see that in Node you are using 64536 for memory cost instead of 65536 like you do on .NET

from node-argon2.