{"action":"created","issue":{"url":"https://api.github.com/repos/hynek/argon2_cffi/issues/4","labels_url":"https://api.github.com/repos/hynek/argon2_cffi/issues/4/labels{/name}","comments_url":"https://api.github.com/repos/hynek/argon2_cffi/issues/4/comments","events_url":"https://api.github.com/repos/hynek/argon2_cffi/issues/4/events","html_url":"https://github.com/hynek/argon2_cffi/issues/4","id":125584196,"number":4,"title":"Some parameter combinations cause a password to not validate against itself","user":{"login":"DRMacIver","id":28623,"avatar_url":"https://avatars.githubusercontent.com/u/28623?v=3","gravatar_id":"","url":"https://api.github.com/users/DRMacIver","html_url":"https://github.com/DRMacIver","followers_url":"https://api.github.com/users/DRMacIver/followers","following_url":"https://api.github.com/users/DRMacIver/following{/other_user}","gists_url":"https://api.github.com/users/DRMacIver/gists{/gist_id}","starred_url":"https://api.github.com/users/DRMacIver/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DRMacIver/subscriptions","organizations_url":"https://api.github.com/users/DRMacIver/orgs","repos_url":"https://api.github.com/users/DRMacIver/repos","events_url":"https://api.github.com/users/DRMacIver/events{/privacy}","received_events_url":"https://api.github.com/users/DRMacIver/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2016-01-08T10:33:14Z","updated_at":"2016-01-25T09:25:28Z","closed_at":"2016-01-25T09:25:28Z","body":"Hi, I read [Storing Passwords in a Highly Parallelized World](https://hynek.me/articles/storing-passwords/) and thought it might be interesting to apply [Hypothesis](http://hypothesis.readthedocs.org/) to testing your argon2 bindings.\r\n\r\nThis resulted in the following example:\r\n\r\n```python\r\n    def test_a_password_verifies(self):\r\n        ph = PasswordHasher(\r\n            time_cost=1, parallelism=1,\r\n            memory_cost=8,\r\n            hash_len=4, salt_len=8,\r\n        )\r\n        password = ''\r\n        hash = ph.hash(password)\r\n        assert ph.verify(hash, password)\r\n```\r\ni.e. we set up a hasher with some parameters, then hash a password and validate it against itself. This test passes correctly with the default parameter values but fails with these ones.\r\n\r\nThis fails with \"argon2.exceptions.VerificationError: Decoding failed\"\r\n\r\n(The fact that the password is empty appears to not be significant - it still fails with e.g. '0')\r\n\r\nI'm insufficiently familiar with the problem space to know whether this is likely to be an issue in the bindings, the underlying library, or indeed just me doing something subtly wrong, so I thought I'd pass this over to you.\r\n\r\nI am also happy to submit a pull request to add the original Hypothesis based tests (which just tries a large number of examples like the above) to your suite if you'd like me to."},"comment":{"url":"https://api.github.com/repos/hynek/argon2_cffi/issues/comments/174446512","html_url":"https://github.com/hynek/argon2_cffi/issues/4#issuecomment-174446512","issue_url":"https://api.github.com/repos/hynek/argon2_cffi/issues/4","id":174446512,"user":{"login":"hynek","id":41240,"avatar_url":"https://avatars.githubusercontent.com/u/41240?v=3","gravatar_id":"","url":"https://api.github.com/users/hynek","html_url":"https://github.com/hynek","followers_url":"https://api.github.com/users/hynek/followers","following_url":"https://api.github.com/users/hynek/following{/other_user}","gists_url":"https://api.github.com/users/hynek/gists{/gist_id}","starred_url":"https://api.github.com/users/hynek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hynek/subscriptions","organizations_url":"https://api.github.com/users/hynek/orgs","repos_url":"https://api.github.com/users/hynek/repos","events_url":"https://api.github.com/users/hynek/events{/privacy}","received_events_url":"https://api.github.com/users/hynek/received_events","type":"User","site_admin":false},"created_at":"2016-01-25T09:25:28Z","updated_at":"2016-01-25T09:25:28Z","body":"The latest revision of the bindings appear to have fixed all of this.\r\n\r\nI’ve added a [similar test](https://github.com/hynek/argon2_cffi/blob/675576a6340f331cb84c1d07fa83db75fdb66afa/tests/test_low_level.py#L213-L239) as a smoke test if they break something again.\r\n\r\nThe bindings introduced other breakage but that’s something for other tickets."}}