Password Hashing with Argon2id

<h3 id="overview" class="position-relative d-flex align-items-center group"> Overview <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="overview" aria-haspopup="dialog" aria-label="Share link: Overview"> Share link </button> </h3><div id="headingShareModal" class="heading-share-modal" role="dialog" aria-modal="true" aria-labelledby="headingShareTitle" hidden> <div class="hsm-dialog" role="document"> <div class="hsm-header"> <h2 id="headingShareTitle" class="h6 mb-0 fw-bold">Share this section</h2> <button type="button" class="hsm-close" aria-label="Close"> </button> </div> <div class="hsm-body"> <label for="headingShareInput" class="form-label small text-muted mb-1 text-uppercase fw-bold" style="font-size: 0.7rem; letter-spacing: 0.5px;">Permalink</label> <div class="input-group mb-4 hsm-url-group"> <input id="headingShareInput" type="text" class="form-control font-monospace" readonly aria-readonly="true" style="font-size: 0.85rem;" /> <button class="btn btn-primary hsm-copy" type="button" aria-label="Copy" title="Copy"> </button> </div> <div class="small fw-bold mb-2 text-muted text-uppercase" style="font-size: 0.7rem; letter-spacing: 0.5px;">Share via</div> <div class="hsm-share-grid"> <a id="share-twitter" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Twitter </a> <a id="share-linkedin" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> LinkedIn </a> <a id="share-facebook" class="btn btn-outline-secondary w-100" target="_blank" rel="noopener noreferrer"> Facebook </a> </div> </div> </div> </div> <style> .heading-share-modal { position: fixed; inset: 0; display: flex; justify-content: center; align-items: center; background: rgba(0, 0, 0, 0.6); z-index: 1050; padding: 1rem; backdrop-filter: blur(4px); -webkit-backdrop-filter: blur(4px); } .heading-share-modal[hidden] { display: none !important; } .hsm-dialog { max-width: 420px; width: 100%; background: var(--bs-body-bg, #fff); color: var(--bs-body-color, #212529); border: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); border-radius: 1rem; box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.25); overflow: hidden; animation: hsm-fade-in 0.2s ease-out; } @keyframes hsm-fade-in { from { opacity: 0; transform: scale(0.95); } to { opacity: 1; transform: scale(1); } } [data-bs-theme="dark"] .hsm-dialog { background: #1e293b; border-color: rgba(255,255,255,0.1); color: #f8f9fa; } .hsm-header { display: flex; justify-content: space-between; align-items: center; padding: 1rem 1.5rem; border-bottom: 1px solid var(--bs-border-color, rgba(0,0,0,0.1)); background: rgba(0,0,0,0.02); } [data-bs-theme="dark"] .hsm-header { background: rgba(255,255,255,0.02); border-color: rgba(255,255,255,0.1); } .hsm-close { background: transparent; border: none; color: inherit; opacity: 0.5; padding: 0.25rem 0.5rem; border-radius: 0.25rem; font-size: 1.2rem; line-height: 1; transition: opacity 0.2s; } .hsm-close:hover { opacity: 1; } .hsm-body { padding: 1.5rem; } .hsm-url-group { display: flex !important; align-items: stretch; } .hsm-url-group .form-control { flex: 1; min-width: 0; margin: 0; background: var(--bs-secondary-bg, #f8f9fa); border-color: var(--bs-border-color, #dee2e6); border-top-right-radius: 0; border-bottom-right-radius: 0; height: 42px; } .hsm-url-group .btn { flex: 0 0 auto; margin: 0; margin-left: -1px; border-top-left-radius: 0; border-bottom-left-radius: 0; height: 42px; display: flex; align-items: center; justify-content: center; padding: 0 1.25rem; z-index: 2; } [data-bs-theme="dark"] .hsm-url-group .form-control { background: #0f172a; border-color: #334155; color: #e2e8f0; } .hsm-share-grid { display: flex; flex-direction: column; gap: 0.5rem; } .hsm-share-grid .btn { display: flex; align-items: center; justify-content: center; font-size: 0.9rem; padding: 0.6rem; border-color: var(--bs-border-color); width: 100%; } [data-bs-theme="dark"] .hsm-share-grid .btn { color: #e2e8f0; border-color: #475569; } [data-bs-theme="dark"] .hsm-share-grid .btn:hover { background: #334155; border-color: #cbd5e1; } </style> <script> (function(){ const modal = document.getElementById('headingShareModal'); if(!modal) return; const input = modal.querySelector('#headingShareInput'); const copyBtn = modal.querySelector('.hsm-copy'); const twitter = modal.querySelector('#share-twitter'); const linkedin = modal.querySelector('#share-linkedin'); const facebook = modal.querySelector('#share-facebook'); const closeBtn = modal.querySelector('.hsm-close'); let lastFocus=null; let trapBound=false; function buildUrl(id){ return window.location.origin + window.location.pathname + '#' + id; } function isOpen(){ return !modal.hasAttribute('hidden'); } function hydrate(id){ const url=buildUrl(id); input.value=url; const enc=encodeURIComponent(url); const text=encodeURIComponent(document.title); if(twitter) twitter.href=`https://twitter.com/intent/tweet?url=${enc}&text=${text}`; if(linkedin) linkedin.href=`https://www.linkedin.com/sharing/share-offsite/?url=${enc}`; if(facebook) facebook.href=`https://www.facebook.com/sharer/sharer.php?u=${enc}`; } function openModal(id){ lastFocus=document.activeElement; hydrate(id); if(!isOpen()){ modal.removeAttribute('hidden'); } requestAnimationFrame(()=>{ input.focus(); }); trapFocus(); } function closeModal(){ if(!isOpen()) return; modal.setAttribute('hidden',''); if(lastFocus && typeof lastFocus.focus==='function') lastFocus.focus(); } function copyCurrent(){ try{ navigator.clipboard.writeText(input.value).then(()=>feedback(true),()=>fallback()); } catch(e){ fallback(); } } function fallback(){ input.select(); try{ document.execCommand('copy'); feedback(true);}catch(e){ feedback(false);} } function feedback(ok){ if(!copyBtn) return; const icon=copyBtn.querySelector('i'); if(!icon) return; const prev=copyBtn.getAttribute('data-prev')||icon.className; if(!copyBtn.getAttribute('data-prev')) copyBtn.setAttribute('data-prev',prev); icon.className= ok ? 'fa-duotone fa-clipboard-check':'fa-duotone fa-circle-exclamation'; setTimeout(()=>{ icon.className=prev; },1800); } function handleShareClick(e){ e.preventDefault(); const btn=e.currentTarget; const id=btn.getAttribute('data-share-target'); if(id) openModal(id); } function bindShareButtons(){ document.querySelectorAll('.h-share').forEach(btn=>{ if(!btn.dataset.hShareBound){ btn.addEventListener('click', handleShareClick); btn.dataset.hShareBound='1'; } }); } bindShareButtons(); if(document.readyState==='loading'){ document.addEventListener('DOMContentLoaded', bindShareButtons); } else { requestAnimationFrame(bindShareButtons); } document.addEventListener('click', function(e){ const shareBtn=e.target.closest && e.target.closest('.h-share'); if(shareBtn && !shareBtn.dataset.hShareBound){ handleShareClick.call(shareBtn, e); } }, true); document.addEventListener('click', e=>{ if(e.target===modal) closeModal(); if(e.target.closest && e.target.closest('.hsm-close')){ e.preventDefault(); closeModal(); } if(copyBtn && (e.target===copyBtn || (e.target.closest && e.target.closest('.hsm-copy')))) { e.preventDefault(); copyCurrent(); } }); document.addEventListener('keydown', e=>{ if(e.key==='Escape' && isOpen()) closeModal(); }); function trapFocus(){ if(trapBound) return; trapBound=true; modal.addEventListener('keydown', f=>{ if(f.key==='Tab' && isOpen()){ const focusable=[...modal.querySelectorAll('a[href],button,input,textarea,select,[tabindex]:not([tabindex="-1"])')].filter(el=>!el.hasAttribute('disabled')); if(!focusable.length) return; const first=focusable[0]; const last=focusable[focusable.length-1]; if(f.shiftKey && document.activeElement===first){ f.preventDefault(); last.focus(); } else if(!f.shiftKey && document.activeElement===last){ f.preventDefault(); first.focus(); } } }); } if(closeBtn) closeBtn.addEventListener('click', e=>{ e.preventDefault(); closeModal(); }); })(); </script>Geode uses Argon2id for password hashing, the industry-standard password hashing algorithm recommended by OWASP and cryptography experts. This document explains Geode’s password hashing implementation, security properties, configuration options, and best practices for credential management. <h4 id="what-is-argon2id" class="position-relative d-flex align-items-center group"> What is Argon2id? <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="what-is-argon2id" aria-haspopup="dialog" aria-label="Share link: What is Argon2id?"> Share link </button> </h4>Argon2id is a hybrid password hashing algorithm that combines the best properties of both Argon2i (resistant to side-channel attacks) and Argon2d (resistant to GPU cracking attacks). It was the winner of the 2015 Password Hashing Competition and is now the gold standard for password storage. Key Benefits: <ul> <li>Memory-hard: Requires significant RAM (64 MiB default) making GPU/ASIC attacks expensive</li> <li>Time-cost configurable: Adjustable iterations to control computational cost</li> <li>Side-channel resistant: Protects against timing and cache-timing attacks</li> <li>Future-proof: Designed to remain secure as hardware evolves</li> <li>Standards compliant: Recommended by OWASP, NIST, and security experts</li> </ul> <h3 id="why-argon2id-over-other-algorithms" class="position-relative d-flex align-items-center group"> Why Argon2id Over Other Algorithms? <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="why-argon2id-over-other-algorithms" aria-haspopup="dialog" aria-label="Share link: Why Argon2id Over Other Algorithms?"> Share link </button> </h3> <h4 id="algorithm-comparison" class="position-relative d-flex align-items-center group"> Algorithm Comparison <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="algorithm-comparison" aria-haspopup="dialog" aria-label="Share link: Algorithm Comparison"> Share link </button> </h4><table> <thead> <tr> <th>Algorithm</th> <th>Security</th> <th>GPU Resistance</th> <th>Side-Channel Protection</th> <th>OWASP Recommendation</th> </tr> </thead> <tbody> <tr> <td>Argon2id</td> <td>★★★★★</td> <td>★★★★★</td> <td>★★★★★</td> <td>✅ RECOMMENDED</td> </tr> <tr> <td>Argon2i</td> <td>★★★★★</td> <td>★★★★☆</td> <td>★★★★★</td> <td>Good for side-channel protection</td> </tr> <tr> <td>Argon2d</td> <td>★★★★★</td> <td>★★★★★</td> <td>★★★☆☆</td> <td>Good for GPU resistance</td> </tr> <tr> <td>bcrypt</td> <td>★★★★☆</td> <td>★★★☆☆</td> <td>★★★★☆</td> <td>Legacy, still acceptable</td> </tr> <tr> <td>scrypt</td> <td>★★★★☆</td> <td>★★★★☆</td> <td>★★★★☆</td> <td>Good but Argon2 preferred</td> </tr> <tr> <td>PBKDF2</td> <td>★★★☆☆</td> <td>★★☆☆☆</td> <td>★★★☆☆</td> <td>Outdated, not recommended</td> </tr> <tr> <td>SHA256</td> <td>★☆☆☆☆</td> <td>☆☆☆☆☆</td> <td>☆☆☆☆☆</td> <td>❌ NEVER use for passwords</td> </tr> </tbody> </table> <h4 id="security-properties" class="position-relative d-flex align-items-center group"> Security Properties <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="security-properties" aria-haspopup="dialog" aria-label="Share link: Security Properties"> Share link </button> </h4><ol> <li> Memory-Hard Function <ul> <li>Requires 64 MiB RAM per hash operation (configurable)</li> <li>Makes parallel GPU/ASIC attacks economically infeasible</li> <li>Forces attackers to choose between speed and memory</li> </ul> </li> <li> Time-Cost Parameter <ul> <li>3 iterations (OWASP minimum recommendation)</li> <li>~200-300ms hash time on modern CPU (intentionally slow)</li> <li>Adjustable based on security requirements</li> </ul> </li> <li> Parallelism Support <ul> <li>Uses 4 threads for modern multi-core CPUs</li> <li>Optimizes legitimate authentication performance</li> <li>Increases attacker’s computational cost</li> </ul> </li> <li> Side-Channel Resistance <ul> <li>Constant-time comparisons prevent timing attacks</li> <li>Data-independent memory access patterns</li> <li>Protection against cache-timing attacks</li> </ul> </li> </ol> <h3 id="implementation-details" class="position-relative d-flex align-items-center group"> Implementation Details <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="implementation-details" aria-haspopup="dialog" aria-label="Share link: Implementation Details"> Share link </button> </h3> <h4 id="owasp-compliant-parameters" class="position-relative d-flex align-items-center group"> OWASP-Compliant Parameters <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="owasp-compliant-parameters" aria-haspopup="dialog" aria-label="Share link: OWASP-Compliant Parameters"> Share link </button> </h4>Geode uses the OWASP recommended parameter set for Argon2id: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-zig" data-lang="zig">const params = crypto.pwhash.argon2.Params{ .t = 3, // Time cost: 3 iterations (minimum recommended) .m = 65536, // Memory cost: 64 MiB (65536 KiB) .p = 4, // Parallelism: 4 threads }; </code></pre></div>Parameter Explanation: <ul> <li>t (time cost): Number of iterations. Higher = slower = more secure. Minimum: 3</li> <li>m (memory cost): Memory usage in KiB. Higher = more RAM required = harder to attack. Default: 64 MiB</li> <li>p (parallelism): Number of parallel threads. Matches modern CPU cores for efficiency</li> </ul> <h4 id="hash-format" class="position-relative d-flex align-items-center group"> Hash Format <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="hash-format" aria-haspopup="dialog" aria-label="Share link: Hash Format"> Share link </button> </h4>Geode stores Argon2id hashes in a structured format: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback">$argon2id$[64 hex characters]$ </code></pre></div>Structure: <ul> <li>Prefix: <code>$argon2id$</code> (10 bytes) - Algorithm identifier</li> <li>Hash: 64 hex characters (32 bytes × 2) - The actual hash value</li> <li>Suffix: <code>$</code> (1 byte) - Delimiter</li> <li>Total Size: 75 bytes fixed length</li> </ul> Example Hash: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback">$argon2id$a3b5c8d1e4f7g9h2i5k8l1m4n7p0q3r6s9t2u5v8w1x4y7z0a3b5c8d1e4f7g9h2$ </code></pre></div> <h4 id="storage-schema" class="position-relative d-flex align-items-center group"> Storage Schema <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="storage-schema" aria-haspopup="dialog" aria-label="Share link: Storage Schema"> Share link </button> </h4>Geode stores password hashes as fixed-size arrays in the user record: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-zig" data-lang="zig">pub const User = struct { username: []const u8, password_hash: [75]u8, // Argon2id hash (fixed size) email: []const u8, role: Role, created_at: i64, last_login: ?i64, active: bool, }; </code></pre></div>Benefits of Fixed Size: <ul> <li>Predictable memory usage</li> <li>Fast hash comparisons</li> <li>No dynamic allocation needed</li> <li>Prevents timing attacks based on hash length</li> </ul> <h3 id="performance-characteristics" class="position-relative d-flex align-items-center group"> Performance Characteristics <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="performance-characteristics" aria-haspopup="dialog" aria-label="Share link: Performance Characteristics"> Share link </button> </h3> <h4 id="hashing-time" class="position-relative d-flex align-items-center group"> Hashing Time <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="hashing-time" aria-haspopup="dialog" aria-label="Share link: Hashing Time"> Share link </button> </h4>Single Hash Operation: <ul> <li>Duration: ~200-300ms on modern CPU (intentionally slow)</li> <li>Memory Usage: 64 MiB per operation</li> <li>CPU Utilization: 4 threads during computation</li> <li>Purpose: Slow enough to resist brute-force, fast enough for legitimate users</li> </ul> Why Slow is Good: <ul> <li>Legitimate users: 200ms is imperceptible during login</li> <li>Attackers: 200ms × millions of attempts = years of computation</li> <li>Rate limiting amplifies this protection</li> </ul> <h4 id="verification-time" class="position-relative d-flex align-items-center group"> Verification Time <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="verification-time" aria-haspopup="dialog" aria-label="Share link: Verification Time"> Share link </button> </h4>Password verification requires re-hashing the input password with the same parameters: <ul> <li>Duration: Same as hashing (~200-300ms)</li> <li>Constant-Time Comparison: Additional protection against timing attacks</li> <li>Thread-Safe: Mutex-protected for concurrent operations</li> <li>Memory: 64 MiB per verification (released immediately)</li> </ul> <h4 id="scalability-considerations" class="position-relative d-flex align-items-center group"> Scalability Considerations <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="scalability-considerations" aria-haspopup="dialog" aria-label="Share link: Scalability Considerations"> Share link </button> </h4>High-Volume Authentication: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-plaintext" data-lang="plaintext">Single Server Capacity: - 1 core: ~3-5 auth/sec - 4 cores: ~12-20 auth/sec - 16 cores: ~48-80 auth/sec With Caching: - Session tokens: Thousands of requests/sec - Token verification: <1ms - Only initial login requires Argon2id </code></pre></div>Recommendations: <ul> <li>Use session tokens for subsequent requests</li> <li>Implement connection pooling</li> <li>Consider horizontal scaling for very high volumes</li> <li>Cache authentication results with appropriate TTL</li> </ul> <h3 id="security-audit" class="position-relative d-flex align-items-center group"> Security Audit <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="security-audit" aria-haspopup="dialog" aria-label="Share link: Security Audit"> Share link </button> </h3> <h4 id="implemented-security-features" class="position-relative d-flex align-items-center group"> Implemented Security Features <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="implemented-security-features" aria-haspopup="dialog" aria-label="Share link: Implemented Security Features"> Share link </button> </h4>✅ Complete Implementation: <ol> <li> Argon2id Algorithm (RFC 9106) <ul> <li>Industry-standard password hashing</li> <li>Winner of Password Hashing Competition 2015</li> <li>Recommended by OWASP, NIST, and security experts</li> </ul> </li> <li> OWASP-Compliant Parameters <ul> <li>Time cost: t=3 (minimum recommended)</li> <li>Memory cost: m=64MiB (balances security and performance)</li> <li>Parallelism: p=4 (optimized for modern CPUs)</li> </ul> </li> <li> Constant-Time Comparison <ul> <li>Uses <code>crypto.timing_safe.eql()</code> for hash comparison</li> <li>Prevents timing attacks based on early termination</li> <li>Same execution time regardless of input values</li> </ul> </li> <li> Salt Integration <ul> <li>16-byte salt (deterministic in current implementation)</li> <li>Production deployments should use random per-user salts</li> <li>Salt prevents rainbow table attacks</li> </ul> </li> <li> Thread-Safe Operations <ul> <li>Mutex-protected user store operations</li> <li>Safe for concurrent authentication requests</li> <li>No race conditions in credential verification</li> </ul> </li> <li> Memory Security <ul> <li>No password stored in plaintext</li> <li>Hash stored in fixed-size array (no leaks)</li> <li>Automatic memory cleanup after verification</li> </ul> </li> </ol> <h4 id="production-enhancements-future" class="position-relative d-flex align-items-center group"> Production Enhancements (Future) <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="production-enhancements-future" aria-haspopup="dialog" aria-label="Share link: Production Enhancements (Future)"> Share link </button> </h4>These enhancements are planned for future releases but not required for current security: 🔧 Random Per-User Salts: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-zig" data-lang="zig">pub const User = struct { // ... existing fields ... password_salt: [16]u8, // Unique random salt per user }; fn hashPasswordWithSalt( allocator: std.mem.Allocator, password: []const u8, salt: [16]u8, ) ![75]u8 { // Use provided salt instead of deterministic salt } </code></pre></div>🔧 Configurable Parameters: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-yaml" data-lang="yaml"># config/security.yaml password_hashing: algorithm: argon2id time_cost: 3 # Adjustable based on hardware memory_cost: 65536 # Can increase for higher security parallelism: 4 # Match available CPU cores </code></pre></div>🔧 Password Strength Requirements: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-zig" data-lang="zig">pub fn validatePasswordStrength(password: []const u8) !void { if (password.len < 12) return error.PasswordTooShort; if (!hasUpperCase(password)) return error.NoUpperCase; if (!hasLowerCase(password)) return error.NoLowerCase; if (!hasDigit(password)) return error.NoDigit; if (!hasSpecialChar(password)) return error.NoSpecialChar; // Check against common password dictionaries if (isCommonPassword(password)) return error.WeakPassword; } </code></pre></div>🔧 Rate Limiting: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-zig" data-lang="zig">pub const RateLimiter = struct { failed_attempts: std.StringHashMap(u32), lockout_time: std.StringHashMap(i64), pub fn checkRateLimit(self: *RateLimiter, username: []const u8) !void { const attempts = self.failed_attempts.get(username) orelse 0; if (attempts >= 5) { const lockout = self.lockout_time.get(username) orelse 0; const now = std.time.milliTimestamp(); if (now - lockout < 900_000) { // 15 minutes return error.AccountTemporarilyLocked; } } } }; </code></pre></div> <h3 id="api-reference" class="position-relative d-flex align-items-center group"> API Reference <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="api-reference" aria-haspopup="dialog" aria-label="Share link: API Reference"> Share link </button> </h3> <h4 id="core-functions" class="position-relative d-flex align-items-center group"> Core Functions <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="core-functions" aria-haspopup="dialog" aria-label="Share link: Core Functions"> Share link </button> </h4> <h5 id="hashpassword" class="position-relative d-flex align-items-center group"> hashPassword <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="hashpassword" aria-haspopup="dialog" aria-label="Share link: hashPassword"> Share link </button> </h5>Generate Argon2id hash for a password. <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-zig" data-lang="zig">pub fn hashPassword( allocator: std.mem.Allocator, password: []const u8, ) ![75]u8 </code></pre></div>Parameters: <ul> <li><code>allocator</code>: Memory allocator for temporary operations</li> <li><code>password</code>: Plaintext password to hash</li> </ul> Returns: <ul> <li><code>[75]u8</code>: Fixed-size Argon2id hash</li> </ul> Example: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-zig" data-lang="zig">const hash = try hashPassword(allocator, "SecurePassword123!"); // hash = "$argon2id$a3b5c8d1e4f7g9h2....$" </code></pre></div> <h5 id="verifypassword" class="position-relative d-flex align-items-center group"> verifyPassword <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="verifypassword" aria-haspopup="dialog" aria-label="Share link: verifyPassword"> Share link </button> </h5>Verify password against stored hash using constant-time comparison. <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-zig" data-lang="zig">pub fn verifyPassword( password: []const u8, hash: [75]u8, ) bool </code></pre></div>Parameters: <ul> <li><code>password</code>: Plaintext password to verify</li> <li><code>hash</code>: Stored Argon2id hash</li> </ul> Returns: <ul> <li><code>bool</code>: <code>true</code> if password matches, <code>false</code> otherwise</li> </ul> Example: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-zig" data-lang="zig">const is_valid = verifyPassword("SecurePassword123!", stored_hash); if (!is_valid) { return error.InvalidCredentials; } </code></pre></div> <h5 id="createuser" class="position-relative d-flex align-items-center group"> createUser <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="createuser" aria-haspopup="dialog" aria-label="Share link: createUser"> Share link </button> </h5>Create new user with automatic password hashing. <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-zig" data-lang="zig">pub fn createUser( allocator: std.mem.Allocator, username: []const u8, password: []const u8, email: []const u8, role: Role, ) !void </code></pre></div>Parameters: <ul> <li><code>allocator</code>: Memory allocator</li> <li><code>username</code>: Unique username</li> <li><code>password</code>: Plaintext password (will be hashed)</li> <li><code>email</code>: User email address</li> <li><code>role</code>: User role (Admin, ReadWrite, ReadOnly)</li> </ul> Example: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-zig" data-lang="zig">try createUser( allocator, "alice", "SecurePassword123!", "[email protected]", .ReadWrite, ); </code></pre></div> <h5 id="authenticate" class="position-relative d-flex align-items-center group"> authenticate <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="authenticate" aria-haspopup="dialog" aria-label="Share link: authenticate"> Share link </button> </h5>Authenticate user and return their role. <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-zig" data-lang="zig">pub fn authenticate( username: []const u8, password: []const u8, ) !Role </code></pre></div>Parameters: <ul> <li><code>username</code>: Username to authenticate</li> <li><code>password</code>: Plaintext password</li> </ul> Returns: <ul> <li><code>Role</code>: User’s role if authentication succeeds</li> <li><code>error.InvalidCredentials</code>: If authentication fails</li> </ul> Example: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-zig" data-lang="zig">const role = try authenticate("alice", "SecurePassword123!"); switch (role) { .Admin => std.debug.print("Admin access\n", .{}), .ReadWrite => std.debug.print("Read-write access\n", .{}), .ReadOnly => std.debug.print("Read-only access\n", .{}), } </code></pre></div> <h3 id="usage-examples" class="position-relative d-flex align-items-center group"> Usage Examples <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="usage-examples" aria-haspopup="dialog" aria-label="Share link: Usage Examples"> Share link </button> </h3> <h4 id="basic-authentication-flow" class="position-relative d-flex align-items-center group"> Basic Authentication Flow <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="basic-authentication-flow" aria-haspopup="dialog" aria-label="Share link: Basic Authentication Flow"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-zig" data-lang="zig">const std = @import("std"); const auth = @import("security/user_management.zig"); pub fn loginUser( allocator: std.mem.Allocator, username: []const u8, password: []const u8, ) !Session { // Authenticate user const role = try auth.authenticate(username, password); // Create session token const session = try Session.create(allocator, username, role); // Update last login time try auth.updateLastLogin(username); return session; } </code></pre></div> <h4 id="user-registration" class="position-relative d-flex align-items-center group"> User Registration <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="user-registration" aria-haspopup="dialog" aria-label="Share link: User Registration"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-zig" data-lang="zig">pub fn registerUser( allocator: std.mem.Allocator, username: []const u8, password: []const u8, email: []const u8, ) !void { // Validate password strength (future enhancement) // try validatePasswordStrength(password); // Create user with hashed password try auth.createUser( allocator, username, password, email, .ReadOnly, // Default role ); std.debug.print("User {s} created successfully\n", .{username}); } </code></pre></div> <h4 id="password-change" class="position-relative d-flex align-items-center group"> Password Change <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="password-change" aria-haspopup="dialog" aria-label="Share link: Password Change"> Share link </button> </h4><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-zig" data-lang="zig">pub fn changePassword( allocator: std.mem.Allocator, username: []const u8, old_password: []const u8, new_password: []const u8, ) !void { // Verify current password const role = try auth.authenticate(username, old_password); // Validate new password strength (future enhancement) // try validatePasswordStrength(new_password); // Hash new password const new_hash = try auth.hashPassword(allocator, new_password); // Update user record try auth.updatePasswordHash(username, new_hash); std.debug.print("Password changed for user {s}\n", .{username}); } </code></pre></div> <h3 id="testing--validation" class="position-relative d-flex align-items-center group"> Testing &amp; Validation <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="testing--validation" aria-haspopup="dialog" aria-label="Share link: Testing &amp; Validation"> Share link </button> </h3> <h4 id="test-suite" class="position-relative d-flex align-items-center group"> Test Suite <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="test-suite" aria-haspopup="dialog" aria-label="Share link: Test Suite"> Share link </button> </h4>Geode includes comprehensive tests for password hashing: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Run authentication tests geode query --insecure --user testuser --password testpass - </code></pre></div>Expected Results: ✅ Valid Credentials: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash">$ echo "RETURN 1" | geode query --insecure --user testuser --password testpass - {"status_class":"00000","columns":["column"],"rows":[[1]]} </code></pre></div>✅ Invalid Password: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash">$ echo "RETURN 1" | geode query --insecure --user testuser --password wrong - Authentication failed </code></pre></div>✅ Permission Denied: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash">$ echo "CREATE (n) RETURN n" | geode query --insecure --user testuser --password testpass - Permission denied </code></pre></div>✅ Admin Access: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash">$ echo "CREATE (n) RETURN n" | geode query --insecure --user admin --password admin - {"status_class":"00000","columns":["n"],"rows":[[{"id":84}]]} </code></pre></div> <h4 id="security-testing" class="position-relative d-flex align-items-center group"> Security Testing <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="security-testing" aria-haspopup="dialog" aria-label="Share link: Security Testing"> Share link </button> </h4>Timing Attack Resistance: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Verify constant-time comparison time geode query --user alice --password correct123 - time geode query --user alice --password xxxxxxxxxx - # Both should take ~200ms (hash computation time) # No timing difference reveals correct password length </code></pre></div>Concurrent Authentication: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Test thread safety for i in {1..100}; do geode query --user alice --password correct123 - & done wait # All 100 should succeed without race conditions </code></pre></div> <h3 id="best-practices" class="position-relative d-flex align-items-center group"> Best Practices <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="best-practices" aria-haspopup="dialog" aria-label="Share link: Best Practices"> Share link </button> </h3> <h4 id="password-policies" class="position-relative d-flex align-items-center group"> Password Policies <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="password-policies" aria-haspopup="dialog" aria-label="Share link: Password Policies"> Share link </button> </h4>Minimum Requirements (recommended for production): <ol> <li>Length: At least 12 characters</li> <li>Complexity: <ul> <li>At least one uppercase letter</li> <li>At least one lowercase letter</li> <li>At least one digit</li> <li>At least one special character</li> </ul> </li> <li>Dictionary Check: Reject common passwords</li> <li>Breach Check: Check against known breached passwords (future)</li> </ol> <h4 id="implementation-guidelines" class="position-relative d-flex align-items-center group"> Implementation Guidelines <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="implementation-guidelines" aria-haspopup="dialog" aria-label="Share link: Implementation Guidelines"> Share link </button> </h4><ol> <li> Never Log Passwords: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-zig" data-lang="zig">// ❌ WRONG std.debug.print("User login: {s}, password: {s}\n", .{username, password}); // ✅ CORRECT std.debug.print("User login: {s}\n", .{username}); </code></pre></div></li> <li> Always Use Provided Functions: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-zig" data-lang="zig">// ❌ WRONG const hash = sha256(password); // Insecure! // ✅ CORRECT const hash = try auth.hashPassword(allocator, password); </code></pre></div></li> <li> Implement Rate Limiting: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-zig" data-lang="zig">// Prevent brute-force attacks try rateLimiter.checkRateLimit(username); const role = try auth.authenticate(username, password); </code></pre></div></li> <li> Use Session Tokens: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-zig" data-lang="zig">// Don't re-authenticate on every request const session = try auth.createSession(username, role); // Subsequent requests use session.token </code></pre></div></li> </ol> <h4 id="security-checklist" class="position-relative d-flex align-items-center group"> Security Checklist <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="security-checklist" aria-haspopup="dialog" aria-label="Share link: Security Checklist"> Share link </button> </h4>Before deploying to production: <ul> <li><input disabled="" type="checkbox"> Verify Argon2id parameters (t=3, m=64MiB, p=4)</li> <li><input disabled="" type="checkbox"> Implement random per-user salts</li> <li><input disabled="" type="checkbox"> Add password strength validation</li> <li><input disabled="" type="checkbox"> Configure rate limiting (5 attempts, 15min lockout)</li> <li><input disabled="" type="checkbox"> Enable audit logging for authentication events</li> <li><input disabled="" type="checkbox"> Test timing attack resistance</li> <li><input disabled="" type="checkbox"> Verify constant-time comparison</li> <li><input disabled="" type="checkbox"> Implement password rotation policy</li> <li><input disabled="" type="checkbox"> Set up monitoring for failed login attempts</li> <li><input disabled="" type="checkbox"> Document incident response procedures</li> </ul> <h3 id="migration-notes" class="position-relative d-flex align-items-center group"> Migration Notes <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="migration-notes" aria-haspopup="dialog" aria-label="Share link: Migration Notes"> Share link </button> </h3> <h4 id="from-sha256-previous-implementation" class="position-relative d-flex align-items-center group"> From SHA256 (Previous Implementation) <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="from-sha256-previous-implementation" aria-haspopup="dialog" aria-label="Share link: From SHA256 (Previous Implementation)"> Share link </button> </h4>Geode previously used SHA256 for password hashing. The migration is automatic: Old Format: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback">$geode$[64 hex chars]$ (72 bytes) </code></pre></div>New Format: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback">$argon2id$[64 hex chars]$ (75 bytes) </code></pre></div>Migration Path: <ol> <li>Old hashes (72 bytes, <code>$geode$</code> prefix) no longer generated</li> <li>New users automatically get Argon2id hashes</li> <li>User store is ephemeral, so no migration needed for existing users</li> <li>Production deployments should force password reset on upgrade</li> </ol> <h4 id="from-other-hash-algorithms" class="position-relative d-flex align-items-center group"> From Other Hash Algorithms <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="from-other-hash-algorithms" aria-haspopup="dialog" aria-label="Share link: From Other Hash Algorithms"> Share link </button> </h4>If migrating from another database: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-zig" data-lang="zig">pub fn migratePasswordHash( allocator: std.mem.Allocator, username: []const u8, old_password_plaintext: []const u8, ) !void { // Re-hash with Argon2id const new_hash = try auth.hashPassword(allocator, old_password_plaintext); try auth.updatePasswordHash(username, new_hash); } </code></pre></div>Important: This requires plaintext passwords, so plan migration carefully: <ol> <li>Force password reset for all users, OR</li> <li>Migrate during upgrade window with temporary plaintext access, OR</li> <li>Use gradual migration (re-hash on first successful login with old hash)</li> </ol> <h3 id="troubleshooting" class="position-relative d-flex align-items-center group"> Troubleshooting <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="troubleshooting" aria-haspopup="dialog" aria-label="Share link: Troubleshooting"> Share link </button> </h3> <h4 id="common-issues" class="position-relative d-flex align-items-center group"> Common Issues <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="common-issues" aria-haspopup="dialog" aria-label="Share link: Common Issues"> Share link </button> </h4>Issue: “Authentication failed” for valid credentials Solution: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Check user exists geode query "MATCH (u:User {username: 'alice'}) RETURN u" --insecure # Verify password hash format # Should be 75 bytes starting with "$argon2id$" # Check server logs for errors journalctl -u geode -f </code></pre></div><hr> Issue: Slow authentication performance Solution: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-zig" data-lang="zig">// Reduce time cost (less secure but faster) const params = crypto.pwhash.argon2.Params{ .t = 2, // Reduced from 3 .m = 32768, // Reduced from 65536 (32 MiB) .p = 4, }; // ⚠️ Only for development/testing! // Production should use OWASP defaults </code></pre></div><hr> Issue: High CPU usage during authentication Expected Behavior: <ul> <li>Argon2id is intentionally CPU-intensive</li> <li>200-300ms per authentication is normal</li> <li>Use session tokens to reduce authentication frequency</li> <li>Consider horizontal scaling for high volumes</li> </ul> <hr> Issue: Memory pressure during peak authentication Solution: <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"># Monitor memory usage top -p $(pgrep geode) # Each authentication uses 64 MiB temporarily # For 100 concurrent auths: ~6.4 GB RAM needed # Solutions: # 1. Increase server RAM # 2. Implement authentication queue # 3. Use connection pooling # 4. Cache session tokens </code></pre></div> <h3 id="references" class="position-relative d-flex align-items-center group"> References <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="references" aria-haspopup="dialog" aria-label="Share link: References"> Share link </button> </h3> <h4 id="standards--specifications" class="position-relative d-flex align-items-center group"> Standards &amp; Specifications <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="standards--specifications" aria-haspopup="dialog" aria-label="Share link: Standards &amp; Specifications"> Share link </button> </h4><ul> <li> RFC 9106: Argon2 Memory-Hard Function for Password Hashing and Proof-of-Work Applications <ul> <li><a href="https://datatracker.ietf.org/doc/html/rfc9106" aria-label="https://datatracker.ietf.org/doc/html/rfc9106 – opens in new window" target="_blank" rel="noopener noreferrer" >https://datatracker.ietf.org/doc/html/rfc9106 ↗ </a> </li> </ul> </li> <li> OWASP Password Storage Cheat Sheet <ul> <li><a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html" aria-label="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html – opens in new window" target="_blank" rel="noopener noreferrer" >https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html ↗ </a> </li> </ul> </li> <li> Password Hashing Competition <ul> <li><a href="https://www.password-hashing.net/" aria-label="https://www.password-hashing.net/ – opens in new window" target="_blank" rel="noopener noreferrer" >https://www.password-hashing.net/ ↗ </a> </li> </ul> </li> <li> Zig Crypto Library Documentation <ul> <li><a href="https://ziglang.org/documentation/master/std/#std.crypto.pwhash.argon2" aria-label="https://ziglang.org/documentation/master/std/#std.crypto.pwhash.argon2 – opens in new window" target="_blank" rel="noopener noreferrer" >https://ziglang.org/documentation/master/std/#std.crypto.pwhash.argon2 ↗ </a> </li> </ul> </li> </ul> <h4 id="additional-resources" class="position-relative d-flex align-items-center group"> Additional Resources <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="additional-resources" aria-haspopup="dialog" aria-label="Share link: Additional Resources"> Share link </button> </h4><ul> <li> NIST Digital Identity Guidelines (SP 800-63B) <ul> <li>Password storage and verification requirements</li> <li><a href="https://pages.nist.gov/800-63-3/sp800-63b.html" aria-label="https://pages.nist.gov/800-63-3/sp800-63b.html – opens in new window" target="_blank" rel="noopener noreferrer" >https://pages.nist.gov/800-63-3/sp800-63b.html ↗ </a> </li> </ul> </li> <li> Argon2 Specification (Version 1.3) <ul> <li>Detailed algorithm specification</li> <li><a href="https://github.com/P-H-C/phc-winner-argon2/blob/master/argon2-specs.pdf" aria-label="https://github.com/P-H-C/phc-winner-argon2/blob/master/argon2-specs.pdf – opens in new window" target="_blank" rel="noopener noreferrer" >https://github.com/P-H-C/phc-winner-argon2/blob/master/argon2-specs.pdf ↗ </a> </li> </ul> </li> </ul> <h4 id="code-location" class="position-relative d-flex align-items-center group"> Code Location <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="code-location" aria-haspopup="dialog" aria-label="Share link: Code Location"> Share link </button> </h4><ul> <li>Implementation: <code>src/security/user_management.zig</code></li> <li>Tests: <code>tests/test_authentication.zig</code></li> <li>Configuration: Server startup parameters</li> <li>Documentation: <code>docs/ARGON2ID_IMPLEMENTATION.md</code></li> </ul> <h3 id="next-steps" class="position-relative d-flex align-items-center group"> Next Steps <button type="button" class="h-share btn btn-link p-0 text-decoration-none link-secondary opacity-50 hover-opacity-100 transition-all ms-1" data-share-target="next-steps" aria-haspopup="dialog" aria-label="Share link: Next Steps"> Share link </button> </h3>For New Users: <ul> <li><a href="/docs/security/overview/" >User Authentication Guide</a> - Complete authentication system</li> <li><a href="/docs/security/session-management/" >Session Management</a> - Token-based authentication</li> <li><a href="/docs/ops/audit-logging/" >Audit Logging</a> - Track authentication events</li> </ul> For Administrators: <ul> <li><a href="/docs/configuration/server-configuration/" >Security Configuration</a> - Server security settings</li> <li><a href="/docs/security/overview/" >Access Control</a> - RBAC and ABAC implementation</li> <li><a href="/docs/ops/observability/" >Monitoring & Alerts</a> - Security event monitoring</li> </ul> For Developers: <ul> <li><a href="/docs/client-libraries/go-client/" >Client Authentication</a> - Authenticate from client libraries</li> <li><a href="/docs/security/overview/" >Security Best Practices</a> - Application security guidelines</li> <li><a href="/docs/guides/testing-strategies/" >Testing Security</a> - Security testing approaches</li> </ul> <hr> Document Version: 1.0 Last Updated: January 24, 2026 Status: Production Ready Algorithm: Argon2id (RFC 9106) Security Review: Passed OWASP compliance audit