argon2 - npm Package Compare versions

Comparing version 0.1.3 to 0.2.0-1

index.js

 var bindings = require("bindings")("argon2_lib"),
   crypto = require("crypto");
 
-exports.encrypt = function (plain, salt, callback) {
+exports.encrypt = function (plain, salt, options, callback) {
   "use strict";
 
+  if (typeof(callback) == 'undefined') {
+    callback = options;
+    options = {};
+  }
+
+  options.timeCost = options.timeCost || 3;
+  options.memoryCost = options.memoryCost || 12;
+  options.parallelism = options.parallelism || 1;
+
   if (salt.length > 16) {
@@ -14,8 +23,22 @@ process.nextTick(function () {
 
-  return bindings.encrypt(plain, salt, callback);
+  if (options.memoryCost >= 32) {
+    process.nextTick(function() {
+      callback(new Error("Memory cost too high, maximum of 32."), null);
+    });
+    return;
+  }
+
+  return bindings.encrypt(plain, salt, options.timeCost, options.memoryCost,
+    options.parallelism, callback);
 };
 
-exports.encryptSync = function (plain, salt) {
+exports.encryptSync = function (plain, salt, options) {
   "use strict";
 
+  options = options || {};
+
+  options.timeCost = options.timeCost || 3;
+  options.memoryCost = options.memoryCost || 12;
+  options.parallelism = options.parallelism || 1;
+
   if (salt.length > 16) {
@@ -25,3 +48,8 @@ throw new Error("Salt too long, maximum 16 characters.");
 
-  return bindings.encryptSync(plain, salt);
+  if (options.memoryCost >= 32) {
+    throw new Error("Memory cost too high, maximum of 32");
+  }
+
+  return bindings.encryptSync(plain, salt, options.timeCost, options.memoryCost,
+    options.parallelism);
 };
@@ -28,0 +56,0 @@

package.json

 {
   "name": "argon2",
-  "version": "0.1.3",
+  "version": "0.2.0-1",
   "description": "An Argon2 library for Node",
@@ -8,5 +8,6 @@ "main": "index.js",
     "build": "npm run configure && node-gyp build",
-    "clean": "node-gyp clean",
+    "clean": "node-gyp clean && rm index-cov.js",
     "configure": "node-gyp configure",
-    "preinstall": "git submodule init && git submodule update",
+    "coveralls": "jscoverage index.js && ARGON2_COVERAGE=1 nodeunit --reporter=lcov test.spec.js | coveralls",
+    "preinstall": "node-gyp rebuild && git submodule init && git submodule update",
     "test": "npm run build && nodeunit test.spec.js"
@@ -19,6 +20,7 @@ },
   "keywords": [
-    "password",
+    "argon2",
+    "crypto",
+    "encryption",
     "hashing",
-    "argon2",
-    "crypto"
+    "password"
   ],
@@ -33,8 +35,9 @@ "author": "Ranieri Althoff <[e-mail]>",
     "bindings": "^1.2.1",
-    "nan": "^2.1.0",
-    "node-gyp": "^3.2.1"
+    "nan": "^2.1.0"
   },
   "devDependencies": {
+    "coveralls": "^2.11.6",
+    "jscoverage": "^0.6.0",
     "nodeunit": "^0.9.1"
   }
 }

README.md

@@ -1,2 +0,2 @@
-# node-argon2 [![NPM package][npm-image]][npm-url] [![Build status][travis-image]][travis-url] [![Code Climate][codeclimate-image]][codeclimate-url] [![Dependencies][david-dm-image]][david-dm-url]
+# node-argon2 [![NPM package][npm-image]][npm-url] [![Build status][travis-image]][travis-url] [![Coverage status][coveralls-image]][coveralls-url] [![Code Climate][codeclimate-image]][codeclimate-url] [![Dependencies][david-dm-image]][david-dm-url]
 Bindings to the  reference [Argon2](https://github.com/P-H-C/phc-winner-argon2).
@@ -23,5 +23,5 @@ implementation.
 try {
-    var hash = argon2.encryptSync('password', 'somesalt');
+  var hash = argon2.encryptSync('password', 'somesalt');
 } catch (err) {
-    console.log(err);
+  console.log(err);
 }
@@ -45,2 +45,21 @@ ```
 
+You can also modify time, memory and parallelism constraints passing an object
+as the third parameter, with keys `timeCost`, `memoryCost` and `parallelism`,
+respectively defaulted to 3, 12 (meaning 2^12 KB) and 1 (threads):
+```js
+var argon2 = require('argon2');
+
+argon2.encrypt('password', saltGeneratedWithAboveFunction, {
+    timeCost: 4, memoryCost: 13, parallelism: 2
+}, function (err, hash) {
+  // ...
+});
+
+// OR
+
+var hash = argon2.encryptSync('password', saltGeneratedWithAboveFunction, {
+  timeCost: 4, memoryCost: 13, parallelism: 2
+};
+```
+
 To verify a password:
@@ -77,2 +96,4 @@ ```js
 [travis-url]: https://travis-ci.org/ranisalt/node-argon2
+[coveralls-image]: https://img.shields.io/coveralls/ranisalt/node-argon2.svg
+[coveralls-url]: https://coveralls.io/github/ranisalt/node-argon2
 [codeclimate-image]: https://img.shields.io/codeclimate/github/ranisalt/node-argon2.svg
@@ -79,0 +100,0 @@ [codeclimate-url]: https://codeclimate.com/github/ranisalt/node-argon2

test.spec.js

@@ -1,2 +0,4 @@
-var argon2 = require('.');
+var argon2 = process.env.ARGON2_COVERAGE
+  ? require('./index-cov')
+  : require('./index');
 
@@ -31,2 +33,79 @@ module.exports = {
 
+  test_hash_time_cost: function (assert) {
+    "use strict";
+
+    assert.expect(3);
+
+    argon2.encrypt("password", "somesalt", {
+      timeCost: 4
+    }, function (err, hash) {
+      assert.ok(hash, "Hash should be defined.");
+      assert.ok(/m=4096,t=4,p=1/.test(hash), "Hash should have correct time cost.");
+      assert.equal(undefined, err, "Error should not be defined.");
+      assert.done();
+    });
+  },
+
+  test_hash_memory_cost: function (assert) {
+    "use strict";
+
+    assert.expect(3);
+
+    argon2.encrypt("password", "somesalt", {
+      memoryCost: 13
+    }, function (err, hash) {
+      assert.ok(hash, "Hash should be defined.");
+      assert.ok(/m=8192,t=3,p=1/.test(hash), "Hash should have correct memory cost.");
+      assert.equal(undefined, err, "Error should not be defined.");
+      assert.done();
+    });
+  },
+
+  test_hash_high_memory_cost: function (assert) {
+    "use strict";
+
+    assert.expect(3);
+
+    argon2.encrypt("password", "somesalt", {
+      memoryCost: 32
+    }, function (err, hash) {
+      assert.ok(err, "Error should be defined.");
+      assert.equal(err.message, "Memory cost too high, maximum of 32.", "Error message should be equal to expected.");
+      assert.equal(undefined, hash, "Hash should not be defined.");
+      assert.done();
+    });
+  },
+
+  test_hash_parallelism: function (assert) {
+    "use strict";
+
+    assert.expect(3);
+
+    argon2.encrypt("password", "somesalt", {
+      parallelism: 2
+    }, function (err, hash) {
+      assert.ok(hash, "Hash should be defined.");
+      assert.ok(/m=4096,t=3,p=2/.test(hash), "Hash should have correct parallelism.");
+      assert.equal(undefined, err, "Error should not be defined.");
+      assert.done();
+    });
+  },
+
+  test_hash_all_options: function (assert) {
+    "use strict";
+
+    assert.expect(3);
+
+    argon2.encrypt("password", "somesalt", {
+      timeCost: 4,
+      memoryCost: 13,
+      parallelism: 2
+    }, function (err, hash) {
+      assert.ok(hash, "Hash should be defined.");
+      assert.ok(/m=8192,t=4,p=2/.test(hash), "Hash should have correct options.");
+      assert.equal(undefined, err, "Error should not be defined.");
+      assert.done();
+    });
+  },
+
   test_hash_sync: function (assert) {
@@ -43,2 +122,65 @@ "use strict";
 
+  test_hash_sync_time_cost: function (assert) {
+    "use strict";
+
+    assert.expect(1);
+
+    var hash = argon2.encryptSync("password", "somesalt", {
+      timeCost: 4
+    });
+    assert.ok(/m=4096,t=4,p=1/.test(hash),"Hash should have correct time cost.");
+    assert.done();
+  },
+
+  test_hash_sync_memory_cost: function (assert) {
+    "use strict";
+
+    assert.expect(1);
+
+    var hash = argon2.encryptSync("password", "somesalt", {
+      memoryCost: 13
+    });
+    assert.ok(/m=8192,t=3,p=1/.test(hash), "Hash should have correct memory cost.");
+    assert.done();
+  },
+
+  test_hash_sync_high_memory_cost: function (assert) {
+    "use strict";
+
+    assert.expect(1);
+
+    assert.throws(function () {
+      var hash = argon2.encryptSync("password", "somesalt", {
+        memoryCost: 32
+      }, Error, "Error should be thrown.");
+    });
+    assert.done();
+  },
+
+  test_hash_sync_parallelism: function (assert) {
+    "use strict";
+
+    assert.expect(1);
+
+    var hash = argon2.encryptSync("password", "somesalt", {
+      parallelism: 2
+    });
+    assert.ok(/m=4096,t=3,p=2/.test(hash), "Hash should have correct parallelism.");
+    assert.done();
+  },
+
+  test_hash_sync_all_options: function (assert) {
+    "use strict";
+
+    assert.expect(1);
+
+    var hash = argon2.encryptSync("password", "somesalt", {
+      timeCost: 4,
+      memoryCost: 13,
+      parallelism: 2
+    });
+    assert.ok(/m=8192,t=4,p=2/.test(hash),"Hash should have correct options.");
+    assert.done();
+  },
+
   test_hash_sync_long_salt: function (assert) {
@@ -50,3 +192,3 @@ "use strict";
     assert.throws(function () {
-      argon2.encryptSync("password", "somesaltwaytoobig")
+      argon2.encryptSync("password", "somesaltwaytoobig");
     }, Error, "Error should be thrown.");
@@ -53,0 +195,0 @@ assert.done();

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Fixed alerts

Install scripts

Supply chain risk

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Found 1 instance in 1 package

Native code

Supply chain risk

Contains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.

Found 1 instance in 1 package

Improved metrics

Dependency count

2

-33.33%

Lines of code

337

66.01%

Number of lines in readme file

100

26.58%

Number of high supply chain risk alerts

0

-100%

Number of medium supply chain risk alerts

1

-90%

Worsened metrics

Total package byte prevSize

1456475

-15.37%

Dev dependency count

3

200%

Number of package files

45

-39.19%

Number of low supply chain risk alerts

1

Infinity%

Dependency changes

• - Removed

  node-gyp@^3.2.1

• - Removed

  abbrev@1.1.1
  (transitive)

• - Removed

  ajv@6.12.6
  (transitive)

• - Removed

  ansi-regex@2.1.1
  (transitive)

• - Removed

  aproba@1.2.0
  (transitive)

• - Removed

  are-we-there-yet@1.1.7
  (transitive)

• - Removed

  asn1@0.2.6
  (transitive)

• - Removed

  assert-plus@1.0.0
  (transitive)

• - Removed

  asynckit@0.4.0
  (transitive)

• - Removed

  aws-sign2@0.7.0
  (transitive)

• - Removed

  aws4@1.13.2
  (transitive)

• - Removed

  balanced-match@1.0.2
  (transitive)

• - Removed

  bcrypt-pbkdf@1.0.2
  (transitive)

• - Removed

  block-stream@0.0.9
  (transitive)

• - Removed

  brace-expansion@1.1.12
  (transitive)

• - Removed

  caseless@0.12.0
  (transitive)

• - Removed

  code-point-at@1.1.0
  (transitive)

• - Removed

  combined-stream@1.0.8
  (transitive)

• - Removed

  concat-map@0.0.1
  (transitive)

• - Removed

  console-control-strings@1.1.0
  (transitive)

• - Removed

  core-util-is@1.0.21.0.3
  (transitive)

• - Removed

  dashdash@1.14.1
  (transitive)

• - Removed

  delayed-stream@1.0.0
  (transitive)

• - Removed

  delegates@1.0.0
  (transitive)

• - Removed

  ecc-jsbn@0.1.2
  (transitive)

• - Removed

  extend@3.0.2
  (transitive)

• - Removed

  extsprintf@1.3.0
  (transitive)

• - Removed

  fast-deep-equal@3.1.3
  (transitive)

• - Removed

  fast-json-stable-stringify@2.1.0
  (transitive)

• - Removed

  forever-agent@0.6.1
  (transitive)

• - Removed

  form-data@2.3.3
  (transitive)

• - Removed

  fs.realpath@1.0.0
  (transitive)

• - Removed

  fstream@1.0.12
  (transitive)

• - Removed

  gauge@2.7.4
  (transitive)

• - Removed

  getpass@0.1.7
  (transitive)

• - Removed

  glob@7.2.3
  (transitive)

• - Removed

  graceful-fs@4.2.11
  (transitive)

• - Removed

  har-schema@2.0.0
  (transitive)

• - Removed

  har-validator@5.1.5
  (transitive)

• - Removed

  has-unicode@2.0.1
  (transitive)

• - Removed

  http-signature@1.2.0
  (transitive)

• - Removed

  inflight@1.0.6
  (transitive)

• - Removed

  inherits@2.0.4
  (transitive)

• - Removed

  is-fullwidth-code-point@1.0.0
  (transitive)

• - Removed

  is-typedarray@1.0.0
  (transitive)

• - Removed

  isarray@1.0.0
  (transitive)

• - Removed

  isexe@2.0.0
  (transitive)

• - Removed

  isstream@0.1.2
  (transitive)

• - Removed

  jsbn@0.1.1
  (transitive)

• - Removed

  json-schema@0.4.0
  (transitive)

• - Removed

  json-schema-traverse@0.4.1
  (transitive)

• - Removed

  json-stringify-safe@5.0.1
  (transitive)

• - Removed

  jsprim@1.4.2
  (transitive)

• - Removed

  mime-db@1.52.0
  (transitive)

• - Removed

  mime-types@2.1.35
  (transitive)

• - Removed

  minimatch@3.1.2
  (transitive)

• - Removed

  minimist@1.2.8
  (transitive)

• - Removed

  mkdirp@0.5.6
  (transitive)

• - Removed

  node-gyp@3.8.0
  (transitive)

• - Removed

  nopt@3.0.6
  (transitive)

• - Removed

  npmlog@4.1.2
  (transitive)

• - Removed

  number-is-nan@1.0.1
  (transitive)

• - Removed

  oauth-sign@0.9.0
  (transitive)

• - Removed

  object-assign@4.1.1
  (transitive)

• - Removed

  once@1.4.0
  (transitive)

• - Removed

  os-homedir@1.0.2
  (transitive)

• - Removed

  os-tmpdir@1.0.2
  (transitive)

• - Removed

  osenv@0.1.5
  (transitive)

• - Removed

  path-is-absolute@1.0.1
  (transitive)

• - Removed

  performance-now@2.1.0
  (transitive)

• - Removed

  process-nextick-args@2.0.1
  (transitive)

• - Removed

  psl@1.15.0
  (transitive)

• - Removed

  punycode@2.3.1
  (transitive)

• - Removed

  qs@6.5.3
  (transitive)

• - Removed

  readable-stream@2.3.8
  (transitive)

• - Removed

  request@2.88.2
  (transitive)

• - Removed

  rimraf@2.7.1
  (transitive)

• - Removed

  safe-buffer@5.1.2
  (transitive)

• - Removed

  safer-buffer@2.1.2
  (transitive)

• - Removed

  semver@5.3.0
  (transitive)

• - Removed

  set-blocking@2.0.0
  (transitive)

• - Removed

  signal-exit@3.0.7
  (transitive)

• - Removed

  sshpk@1.18.0
  (transitive)

• - Removed

  string-width@1.0.2
  (transitive)

• - Removed

  string_decoder@1.1.1
  (transitive)

• - Removed

  strip-ansi@3.0.1
  (transitive)

• - Removed

  tar@2.2.2
  (transitive)

• - Removed

  tough-cookie@2.5.0
  (transitive)

• - Removed

  tunnel-agent@0.6.0
  (transitive)

• - Removed

  tweetnacl@0.14.5
  (transitive)

• - Removed

  uri-js@4.4.1
  (transitive)

• - Removed

  util-deprecate@1.0.2
  (transitive)

• - Removed

  uuid@3.4.0
  (transitive)

• - Removed

  verror@1.10.0
  (transitive)

• - Removed

  which@1.3.1
  (transitive)

• - Removed

  wide-align@1.1.5
  (transitive)

• - Removed

  wrappy@1.0.2
  (transitive)