Glihm.Cryptography.Argon2.Wasm 1.0.0

Argon2 wasm for Blazor.

This repo is attempted to provide a quick and easy way to use Argon2 in Blazor.

Motivation

As cryptography in browser is not well supported (yet) by .NET natively, this repo proposes a very thin layer of javascript interoperability with a wasm module compiled directly from Argon2 PHC winner official repository.

Also, it is a great opportunity for me (and I hope contributors) to learn about Web Assembly, how javascript interacts with it, and how to compile external libraries (like Argon2) into Web Assembly using clang without any glue code.

Easy and ready to use with Blazor

After installing the package Glihm.Cryptography.Argon2.Wasm, few lines are required to get it working:

// program.cs
using Glihm.Cryptography.Argon2.Wasm;
...
builder.Services.AddSingleton<Argon2Wasm>();
...

// Component.cs

@using Glihm.Cryptography.Argon2.Wasm
@inject Argon2Wasm _argon2

...

// Hash example.
private async ValueTask<string?>
Argon2Hash(string password, string salt)
{
	Argon2Parameters prs = new()
	{
		Memory = 32,
		Iterations = 1,
		Parallelism = 1,
		HashLength = 16,
		Type = Argon2Type.id
	};

	Argon2HashResult hr = await this._argon2.Hash(
		password,
		salt,
		prs);

	if (hr.Argon2Code != 0)
	{
		Console.Error.WriteLine($"Argon2 error: {hr}");
		return null;
	}
	
	return hr.EncodedHash;
}

// Verify example.
private async ValueTask<bool>
Argon2Verify(string encodedHash, string password)
{
	Argon2VerifyResult vr = await this._argon2.Verify(
		hr.EncodedHash,
		password,
		Argon2Type.id);

	return vr.Argon2Code == 0;
}

Argon2 library and specificity

Argon2 library is not modified. It is a subrepository of this repository, without any modification.

In the Argon2 specification document, it is mentioned that a secret and associated data may be passed along with the password and the salt during hashing. Even if the documentation stipulates that, by default, no secret and associated data are expected, it is possible to use them as the Argon2_Context in the C implementation does refer to them, but does not use them.

For this reason, an extension to the library can be found in the src/argon2_full.c, where the changes are clearly delimited by comments, from the source code of hash and verify from argon2 library.

The changes are very minor. Also, as the default implementation does not expect secret and associated data, they are null by default. You can totally use the library without worrying about them.

But if you want to use them, you can do it as follow:

Argon2HashResult hr = await this._argon2.Hash(
	"password",
	"somesalt",
	prs,
	secret: "mysecret",
	associatedData: "mysuperdata");

// This example uses strings, but there is an overload with byte[].

Argon2VerifyResult vr = await this._argon2.Verify(
	"$argon2id$v=19$m=16,t=2,p=1$RDdpN3lvT1haWmh2elJ2bQ$uv5mjtjnWb4",
	"password",
	Argon2Type.id,
	secret: "mysecret",
	associatedData: "mysuperdata");

Finally, this library does not (yet) verifies all your inputs. But in the near future, the library will do some computation before sending the parameters to the wasm module in order to catch possible inputs errors. In the meantime, you have in the Argon2HashResult and Argon2VerifyResult objects, the string with the reason of the failure, coming directly from argon2 library.