Argon2id password hash format

Ask the community
1

Hi guys and gals - bit of a random question but I was hoping someone might be able to help me with figuring the format of the argon2id password hash used for penpot?

Here’s what I’ve gathered so far:

Example hash: argon2id$f3a21ee141ce793318abe4e4cd353fef$32768$3$2$5dda3aeace9f141a25391c009ff654575b7ed25e57594d6722867f7334b5a51f

Here’s my understanding for each part:

  1. argon2id: The hashing algorithm used.

  2. f3a21ee141ce793318abe4e4cd353fef: This is the salt (in hexadecimal format). 16 bytes

  3. 32768: The memory cost (m) in KiB.

  4. 3: The number of iterations (t).

  5. 2: The parallelism factor (p).

  6. 5dda3aeace9f141a25391c009ff654575b7ed25e57594d6722867f7334b5a51f: This is the actual hash (in hexadecimal format). 32 bytes

  7. The version number is not included explicitly.

  8. The parameters are separated by $ instead of comma as per the standard format.

Now given all the above, I’ve tried to stitch together the output from the standard argon2id output to get it into the format of the above hash but haven’t had any luck so far. Is there anyone that might be able to help? Happy to be contacted at x.com

2

Just coming back to answer my own question after getting very acquainted with the Java implementation of argon2id:

The format of the hashed output is as per below:

“argon2id$#{salt_hex}$#{memory_cost}$#{t_cost}$#{parallelism}$#{hash_hex}”

with the hash_hex being 32 bytes, salt being 16 bytes and t_cost =3, parallelism=2, memory_cost=32768 (kB)