Can't figure out what salt is?
-
For stacking passwords, a package was set.
argon2
♪ For tests, I wrote this code.const argon2 = require('argon2'); const { Buffer } = require('buffer'); const pass = 'password'
const passList = ['qwerty', 'password','zzzz' ]
async function main() {
let salt = Buffer.from('qwertyuiopasdfgh');
const hash = await argon2.hash(pass, { salt }); // $argon2i$v=19$m=4096,t=3,p=1$cXdlcnR5dWlvcGFzZGZnaA$bVkS9BbKvWp8zwR0G3Ft3u8qT3vcAbe7EDjJXxxyI1Mfor (const passItem of passList) { const result = await argon2.verify(hash, passItem) // false, true, false
}
}main()
As can be seen in the method
verify
I only pass the password and his hash, which can leak. I don't add any salt. I'm waiting to see three.false
♪ But the result is different. The password is fixed.The code is written for dock reasons. https://github.com/ranisalt/node-argon2
-
Because the salt is in the hush. There she is.
cXdlcnR5dWlvcGFzZGZnaA
♪> Buffer.from('qwertyuiopasdfgh').toString('base64') 'cXdlcnR5dWlvcGFzZGZnaA=='
P. S.
Buffer
Node. JS is a global facility, so it's not possible.require
- Yes.