Skip to content
This repository has been archived by the owner on Dec 6, 2020. It is now read-only.
/ poc-argon2-php Public archive

POC in order to materialize prevention concepts described in the following OWASP cheatsheet

Notifications You must be signed in to change notification settings

righettod/poc-argon2-php

Repository files navigation

Introduction

This project is a prototype in order to materialize concepts described in the following OWASP cheatsheet, in Leverage an adaptive one-way function section in PHP technology:

https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet#Leverage_an_adaptive_one-way_function

The objective is to propose a example of secure usage/integration of the Argon2 algorithm in PHP application to protect password when stored by using:

It's the sibling project of this project : https://github.com/righettod/poc-argon2

Configuration options

Argon2 options used are defined here.

Argon2 library integration within an PHP setup

Build Status

The TravisCI integration file .travis.yml show an example of integration of PHP setup with the Argon2 library and execution of unit tests to validate the setup.

Notes

Focus on non-installing binaries from untrusted sources (non official linux repositories - PHC Github repo for Argon2 is considered as trusted because sources are provided and a security code review can be applied)

I have used Ubuntu 14 in order to test proposed configuration strenght capacities on TravisCI cloud environments.

The 3rd party linux repo ondrej/php provide pre-compiled packages for Argon2 and PHP 7.2 but I have decided to not trust it because is not an official repository.

Apparently even on Ubuntu 16, PHP 7.0 is the provided version so manual install is required or using ondrej/php repository

Global setup

Step 0: Install system dependencies

sudo apt-get install gcc clang libxml2-dev unzip wget curl make openssl libssl-dev

Step 1: Install Argon2 from PHC release on Github repository and PHP 7.2 from sources with Argon2 option enabled

The following PHP compilation options are needed by Composer and PHPUnit and not for Argon2:

  • --with-openssl
  • --enable-mbstring
  • --enable-dom
  • --enable-json
  • --enable-xml
  • --enable-libxml

See this complete setup shell script.

Step 2: Install project dependencies and execute unit tests to validate the setup

composer install
/usr/local/bin/php vendor/phpunit/phpunit/phpunit password_util_testcase.php --colors=always --testdox

References:

About

POC in order to materialize prevention concepts described in the following OWASP cheatsheet

Topics

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published