README.md in argon2-0.1.0 vs README.md in argon2-0.1.1
- old
+ new
@@ -1,12 +1,14 @@
-# Argon2
+# Ruby Argon2 Gem
This Ruby Gem provides FFI bindings, and a simplified interface, to the Argon2 algorithm. [Argon2](https://github.com/P-H-C/phc-winner-argon2) is the official winner of the Password Hashing Competition, a several year project to identify a successor to bcrypt/PBKDF/scrypt methods of securely storing passwords. This is an independant project and not official from the PHC team.
-*This gem is now considered a beta release* and at this point is not recommended for production use. It has however moved on to being feature complete and users are encouraged to test this product.
+*This gem is now considered a beta release* and at this point is not recommended for production use. The more detailed advice here, is that it is feature complete, and I do not intend on making backward breaking API changes without bumping the Gem version semantically. There is complete tests and documentation, and I'm working on a project to put this into production.
+However, at this point, the reference C library that we pull in is under active development, ([including from myself](https://github.com/P-H-C/phc-winner-argon2/pulls?q=is%3Apr+author%3Atechnion)), and this binding isn't released grade until that is.
+
[](https://travis-ci.org/technion/ruby-argon2)
[](https://codeclimate.com/github/technion/ruby-argon2)
[](https://codeclimate.com/github/technion/ruby-argon2/coverage)
## Design
@@ -14,14 +16,16 @@
This project has several key tenants to its design:
* The reference Argon2 implementation is to be used "unaltered". To ensure compliance wit this goal, and encourage regular updates from upstream, this is implemented as a git submodule, and is intended to stay that way.
* The FFI interface is kept as slim as possible, with wrapper classes preferred to implementing context structs in FFI
* Security and maintainability take top priority. This can have an impact on platform support. A PR that contains platform specific code paths is unlikely to be accepted.
+* Tested platforms are MRI Ruby 2.2 and JRuby 9000. No assertions are made on other platforms.
* Errors from the C interface are raised as Exceptions. There are a lot of exception classes, but they tend to relate to things like very broken input, and code bugs. Calls to this library should generally not require a rescue.
* Test suits should aim for 100% code coverage.
* Default work values should not be considered constants. I will increase them from time to time.
* Not exposing the threads parameter is a design choice. I believe there is significant risk, and minimal gain in using a value other than '1'. Four threads on a four core box completely ties up the entire server to process one user logon. If you want more security, increase m_cost.
+* Many Rubocop errors have been disabled, but any commit should avoid new alerts or demonstrate their necessity.
## Usage
Require this in your Gemfile like a typical Ruby gem:
@@ -64,9 +68,12 @@
argon = Argon2::Password.new(t_cost: 2, m_cost: 16, secret: KEY)
myhash = argon.hash("A password")
Argon2::Password.verify_password("A password", myhash, KEY)
```
+## RubyDocs documentation
+
+[The usual URL](http://www.rubydoc.info/gems/argon2) will provide detailed documentation.
## FAQ
### Don't roll your own crypto!
This gets its own section because someone will raise it. I did not invent or alter this algorithm, or implement it directly.