Subject: [Cfrg] draft-irtf-cfrg-argon2 variable-length hash function size

From: Matthew Endsley <[email-masked]>
Date: Wed, 20 May 2020 14:58:56 -0700

While implementing argon2 from draft-10, I either incorrectly interpreted a
section or there is an error describing the variable-length hash function
H'.

Section 3.2 lists the operations to perform the Argon2 hash.

This describes the hash function H^x() having an output size of x bytes.

Steps 3 and 4 calculate the initial blocks B[i][0] and B[i][1] as the
result of the variable length hash H'^(128).

I believe this is supposed to be H'^(1024) as the intent is to fill the
entire 1kib block. Using H'^(128) only fills 128 bytes, and generates the
incorrect values for the test vectors. H'^(1024) fills the entire block and
generates the correct values for the test vectors.

Matt

---

From: Loup Vaillant-David <[email-masked]>
Date: Thu, 21 May 2020 18:35:06 +0200

Hi,

I implemented Argon2i for Monocypher, and checked that it does the same
as Libsodium.

I can confirm you want the output of the extended hash to cover 1024
bytes. H'(1024) indeed.

Loup.

On Wed, 2020-05-20 at 14:58 -0700, Matthew Endsley wrote:
> While implementing argon2 from draft-10, I either incorrectly
> interpreted a section or there is an error describing the variable-
> length hash function H'.
> 
> I believe this is supposed to be H'^(1024) as the intent is to fill
> the entire 1kib block. Using H'^(128) only fills 128 bytes, and
> generates the incorrect values for the test vectors. H'^(1024) fills
> the entire block and generates the correct values for the test
> vectors.
> 
> Matt
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg