Can't figure out what salt is?



  • For stacking passwords, a package was set. argon2♪ For tests, I wrote this code.

    const argon2 = require('argon2');
    const { Buffer } = require('buffer');
    const pass = 'password'
    

    const passList = ['qwerty', 'password','zzzz' ]

    async function main() {
    let salt = Buffer.from('qwertyuiopasdfgh');
    const hash = await argon2.hash(pass, { salt }); // $argon2i$v=19$m=4096,t=3,p=1$cXdlcnR5dWlvcGFzZGZnaA$bVkS9BbKvWp8zwR0G3Ft3u8qT3vcAbe7EDjJXxxyI1M

    for (const passItem of passList) {
      const result = await argon2.verify(hash, passItem) // false, true, false
    

    }
    }

    main()

    As can be seen in the method verifyI only pass the password and his hash, which can leak. I don't add any salt. I'm waiting to see three. false♪ But the result is different. The password is fixed.

    The code is written for dock reasons. https://github.com/ranisalt/node-argon2



  • Because the salt is in the hush. There she is. cXdlcnR5dWlvcGFzZGZnaA

    > Buffer.from('qwertyuiopasdfgh').toString('base64')
    'cXdlcnR5dWlvcGFzZGZnaA=='
    

    P. S. Buffer Node. JS is a global facility, so it's not possible. require- Yes.



Suggested Topics

  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2
  • 2