Good day to all,
?
this is my first post to the mailing list!
?
I'd like to report that non-binding auth to (Open)LDAP doesn't work if
the latter hashes passwords with ARGON2.
?
Although dovecot (I am using http://2.3.19.1) does support ARGON2 with
libsodium, but it doesn't recoginize hashes beginning
"{ARGON2}$argon2id$" stored (and hashed, using ppolicy module's
hashCleartext) by OpenLDAP.
?
Now, I understand that ARGON2I, -D, and -ID are not compatible, but the ACTUAL
algorithm is there between the two $.
Furthermore, I think dovecot is in the minority here, I haven't met any
software that specifies the ARGON2 subtype between {}.
BTW, I haven't met any software that hashes passwords with ARGON2, but not
with the ARGON2ID subtype (where libsodium is available, which also seems to be
the standard here), as THAT is the recommended one anyway.
I patched the rpm in OpenSUSE repo to alias {ARGON2} to {ARGON2ID}:
https://build.opensuse.org/package/view_file/home:Samonitari:branches:openSUSE:Factory/dovecot23/dovecot-2.3.0-alias_ARGON2_to_ARGON2ID.patch
?
Could we get something like this (but maybe more correct) into the official
source?
Maybe a config switch to alias it runtime?
?
Thanks for the attention:
Kriszti?n
> On 15/11/2022 14:45 EET Kriszti?n Szegi <oni-dono at mszk.eu> wrote: > > > Good day to all, > ? > this is my first post to the mailing list! > ? > I'd like to report that non-binding auth to (Open)LDAP doesn't work if the latter hashes passwords with ARGON2. > ? > Although dovecot (I am using http://2.3.19.1) does support ARGON2 with libsodium, but it doesn't recoginize hashes beginning "{ARGON2}$argon2id$" stored (and hashed, using ppolicy module's hashCleartext) by OpenLDAP. > ? > Now, I understand that ARGON2I, -D, and -ID are not compatible, but the ACTUAL algorithm is there between the two $. > Furthermore, I think dovecot is in the minority here, I haven't met any software that specifies the ARGON2 subtype between {}. > BTW, I haven't met any software that hashes passwords with ARGON2, but not with the ARGON2ID subtype (where libsodium is available, which also seems to be the standard here), as THAT is the recommended one anyway. > > I patched the rpm in OpenSUSE repo to alias {ARGON2} to {ARGON2ID}: > https://build.opensuse.org/package/view_file/home:Samonitari:branches:openSUSE:Factory/dovecot23/dovecot-2.3.0-alias_ARGON2_to_ARGON2ID.patch > ? > Could we get something like this (but maybe more correct) into the official source? > Maybe a config switch to alias it runtime? > ? > Thanks for the attention: > Kriszti?nHi! Thanks for your report. I think it makes sense, we'll see what we can do about this. Aki
On 11/15/22 13:45, Kriszti?n Szegi wrote:> I'd like to report that non-binding auth to (Open)LDAP doesn't work > if the latter hashes passwords with ARGON2.Could you please elaborate why using LDAP bind is a problem for you? Ciao, Michael.