Comeonin password hashing library

Do we still need the C++ tools in Windows?

Yes - you still need to compile C code

Hi all,

I have just released version 4.0.0-rc.0 of Comeonin. There are quite a few changes in how it is organized, but upgrading should be quite straightforward.

The first big change is that all of the password hashing algorithms are now optional dependencies of Comeonin, so the first thing you need to do is decide which algorithm you want to use and also include that as a dependency. It is also possible to use the dependency libraries directly, without installing Comeonin.

The second major change is that there is now support for Argon2, the winner of the 2015 Password Hashing Competition. That means that the supported algorithms are Argon2, Bcrypt and Pbkdf2.

There are also a couple of helper functions - add_hash and check_pass, which should reduce the amount of code you write when adding password hashes to the database and / or check a user’s password (by comparing it with a stored hash).

To use this version, add the following to the deps section in your mix.exs file:

{:comeonin, "~> 4.0-rc"},
{:argon2_elixir, "~> 1.2"},

If you are using Bcrypt, use {:bcrypt_elixir, "~> 0.11"}, and if you are using Pbkdf2, add {:pbkdf2_elixir, "0.11"}.

Here is the full changelog:

• Enhancements
  • Added support for Argon2 (as an optional dependency – argon2_elixir)
  • Added higher-level helper functions to each algorithm’s module
    • These functions accept / return maps and should reduce code use when adding password hashes / checking passwords
  • Improved the statistics function in each module – report
  • Added sha256 support and django format support to Pbkdf2
• Changes
  • Made all the hashing algorithms optional dependencies
  • Moved the configuration to the separate dependency libraries
  • Removed support for one-time passwords
    • This is now a separate library -
      OneTimePassEcto

If you have any questions / comments, please let me know.

Cool! Since all the modules are now external, do you plan to add a feature to Comeonin that would be able to determine which module to use given a password hash? This would be useful if you have started out with bcrypt and then decide to move to Argon2 for new passwords.

I haven’t really considered having Comeonin determine which module in that way, but I have tried to make the apis for all the algorithms as close as possible (the only differences are in the opts for hashpwsalt, which are algorithm-specific), so changing the algorithm mainly involves changing the module name – from Comeonin.Bcrypt to Comeonin.Argon2 – and then deciding how to configure the new algorithm (how many rounds, etc.).

If your concern is that you will have a mixed set of hashes in the database, and you want some way to determine which module should be used, then I’ll definitely consider that.

I suppose one could also easily implement it for the individual application especially since Bcrypt and Argon2 explicitly prefixes all hashes:

case hash do
  "$2b$" <> _ = hash -> Bcrypt.verify_pass(password, hash)
  "$argon2" <> _ = hash -> Argon2.verify_pass(password, hash)
end

On reflection, I would prefer to handle this use case by adding some information about it in the wiki, rather than making changes to the Comeonin api. As you mention, you can pattern match on the hash to work out which algorithm it is, and that should work out fine.

It seems like dialyxer does not work well with the new rc.

I’ve the following function:

@spec authenticate(String.t, String.t) :: {:ok, User.t} | {:error, term}
def authenticate(email, password) when is_binary(email) and is_binary(password) do
  User
  |> Repo.get_by(email: email)
  |> check_pass(password)
end
def authenticate(_, _), do: {:error, "Incorrect arguments."}

But calling it like this does trigger warnings:

with {:ok, user} <- Authentication.authenticate(email, pass) do
[…]

lib/connect/web/controllers/authentication_controller.ex:19: 
The pattern {'ok', _@4} can never match the type 
{'error',{'error',_} | 
#{'__struct__':='Elixir.Ecto.Changeset', […]}}

And hints what could throw it off here? Not checking the password and returning correct tuples seems to work.

I’m probably going to add dialyxir to each dependency algorithm. I know that otherwise it will give errors for the ‘dummy check’ function. I hope to get that done within the next few days.