Subject: [kitten] Comments on draft-ietf-kitten-password-storage-02

From: [email-masked]
Date: Sun, 22 Nov 2020 22:46:53 -0600 (CST)

scrypt's "output length (dkLen)" of "hLen (length of the chosen hash)" is the same wording as PBKDF2, but you can't choose a hash. Also this doesn't matter because scrypt uses PBKDF2 with 1 iteration so it doesn't suffer from the PBKDF2 footgun.

The password hashing output length should be 128 to 256 bits. More doesn't matter and less can start getting dangerous. Also same applies to Argon2.

---

From: "Sam Whited" <[email-masked]>
Date: Mon, 23 Nov 2020 12:27:52 +0000

On Mon, Nov 23, 2020, at 04:46, [email-masked] wrote:
> scrypt's "output length (dkLen)" of "hLen (length of the chosen hash)"
> is the same wording as PBKDF2, but you can't choose a hash.

Fixed in the next draft, thank you.

> Also same applies to Argon2.

This doesn't appear to be the case for argon2 where I don't list a
length (if I recall correctly the output length isn't one of the argon2
inputs). Is there specific language you think needs to be changed for
the argon2 recommendations? Thanks.

—Sam

---

From: [email-masked]
Date: Mon, 23 Nov 2020 17:22:45 -0600 (CST)

> On 11/23/2020 6:27 AM Sam Whited <[email-masked]> wrote:
>  

Argon2 is a KDF which has a variable output length like scrypt. Most password hash implementations pick this for you. From the official Github page (note "-l 24" is for length):

$ echo -n "password" | ./argon2 somesalt -t 2 -m 16 -p 4 -l 24
Type:           Argon2i
Iterations:     2
Memory:         65536 KiB
Parallelism:    4
Hash:           45d7ac72e76f242b20b77b9bf9bf9d5915894e669a24e6c6
Encoded:        $argon2i$v=19$m=65536,t=2,p=4$c29tZXNhbHQ$RdescudvJCsgt3ub+b+dWRWJTmaaJObG

Note PHP has chosen a 128 bit salt and a 256 bit hash:
$argon2i$v=19$m=65536,t=4,p=1$WFpjTC9IWVJNOXZTYkhaZw$FhfiGVLiI9k7gOt1K9AKOJz8V9Wutz5CMqkvbiksOOo

Also note that PHP can verify this hash "$argon2i$v=19$m=65536,t=2,p=4$c29tZXNhbHQ$RdescudvJCsgt3ub+b+dWRWJTmaaJObG". Even though it's of a different length.

----

For Argon2 and scrypt, it should say something like "if you can pick an output length then choose at least 128 bits and at most 256 bits." Or state it in bytes or just say pick between 128, 192, and 256 bits. Oh technically this also applies to PBKDF2 but with the added part not to output more than hLen.

Hmm I guess just pick one as it doesn't really matter. Yeah I suggest for Argon2 and scrypt to say "default or 24 bytes" and PBKDF2 "min(hLen, 24 bytes)". You can change 24 to whatever I won't bike shed you on that. I like 24 bytes as it's multiple of 3 which is nice with base 64 encoding. Which is kind of a dumb reason but I will back any number bytes 16 to 32.