a108eff9f2
This upgrades `rand_core` to v0.10 prereleases and depends directly on `getrandom` for access to the system RNG. It additionally bumps other crates like `digest` and `blake2` which use the new `crypto-common` with an upgraded `rand_core`. This required restoring some functionality in `blake2` which was used by `argon2`: https://github.com/RustCrypto/hashes/pull/754 This is currently referenced as a git branch until we decide if this is a permanent solution for `argon2` or not, so as to unblock the upgrade.
RustCrypto: Password Hashes
Collection of password hashing algorithms, otherwise known as password-based key derivation functions, written in pure Rust.
Supported Algorithms
| Algorithm | Crate | Crates.io | Documentation | MSRV |
|---|---|---|---|---|
| Argon2 | argon2 |
 |
 |
 |
| Balloon | balloon‑hash |
 |
 |
|
| bcrypt‑pbkdf | bcrypt‑pbkdf |
 |
 |
|
| PBKDF2 | pbkdf2 |
 |
 |
|
| scrypt | scrypt |
 |
 |
|
| SHA-crypt | sha‑crypt |
 |
 |
|
Please see the OWASP Password Storage Cheat Sheet for assistance in selecting an appropriate algorithm for your use case.
Usage
The following code example shows how to verify a password when stored using one of many possible password hashing algorithms implemented in this repository.
use password_hash::{PasswordHash, PasswordVerifier};
use argon2::Argon2;
use pbkdf2::Pbkdf2;
use scrypt::Scrypt;
// Can be: `$argon2`, `$pbkdf2`, or `$scrypt`
let hash_string = "$argon2i$v=19$m=65536,t=1,p=1$c29tZXNhbHQAAAAAAAAAAA$+r0d29hqEB0yasKr55ZgICsQGSkl0v0kgwhd+U3wyRo";
let input_password = "password";
let password_hash = PasswordHash::new(&hash_string).expect("invalid password hash");
// Trait objects for algorithms to support
let algs: &[&dyn PasswordVerifier] = &[&Argon2::default(), &Pbkdf2, &Scrypt];
password_hash.verify_password(algs, input_password).expect("invalid password");
Minimum Supported Rust Version (MSRV) Policy
MSRV bumps are considered breaking changes and will be performed only with minor version bump.
License
All crates licensed under either of
at your option.
Contribution
Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.