README.md in argon2-1.0.0 vs README.md in argon2-1.1.0

- old
+ new

@@ -9,11 +9,11 @@ ## Design This project has several key tenants to its design: -* The reference Argon2 implementation is to be used "unaltered". To ensure compliance wit this goal, and encourage regular updates from upstream, this is implemented as a git submodule, and is intended to stay that way. +* The reference Argon2 implementation is to be used "unaltered". To ensure compliance with this goal, and encourage regular updates from upstream, the upstrema library is implemented as a git submodule, and is intended to stay that way. * The FFI interface is kept as slim as possible, with wrapper classes preferred to implementing context structs in FFI * Security and maintainability take top priority. This can have an impact on platform support. A PR that contains platform specific code paths is unlikely to be accepted. * Tested platforms are MRI Ruby 2.2, 2.3 and JRuby 9000. No assertions are made on other platforms. * Errors from the C interface are raised as Exceptions. There are a lot of exception classes, but they tend to relate to things like very broken input, and code bugs. Calls to this library should generally not require a rescue. * Test suits should aim for 100% code coverage. @@ -32,11 +32,11 @@ To generate a hash using specific time and memory cost: ```ruby hasher = Argon2::Password.new(t_cost: 2, m_cost: 16) hasher.create("password") - => "$argon2i$m=65536,t=2,p=1$6ua7khmHLZwIHnjV2A6nSw$Kak8CTBN/yUYAESSxJKO/jfWH+40c0JQtc7EXhLm0SU" + => "$argon2i$v=19$m=65536,t=2,p=1$jL7lLEAjDN+pY2cG1N8D2g$iwj1ueduCvm6B9YVjBSnAHu+6mKzqGmDW745ALR38Uo" ``` To utilise default costs: ```ruby @@ -46,11 +46,11 @@ Alternatively, use this shotcut: ```ruby Argon2::Password.create("password") - => "$argon2i$m=65536,t=2,p=1$VYXqHZe+5OpNzhbU0LvMZA$XGmkk9tzjYtjatmS5VvuovLvUCfijevwgDzvIkOF+bs" + => "$argon2i$v=19$m=65536,t=2,p=1$61qkSyYNbUgf3kZH3GtHRw$4CQff9AZ0lWd7uF24RKMzqEiGpzhte1Hp8SO7X8bAew" ``` You can then use this function to verify a password against a given hash. Will return either true or false. ```ruby @@ -67,12 +67,13 @@ ``` ## Important notes regarding version 1.0 upgrade Version 1.0.0 included a major version bump over 0.1.4 due to several breaking changes. The first of these was an API change, which you can read the background on [here](https://github.com/technion/ruby-argon2/issues/9). -The second of these is that the reference Argon2 implementation introduced an algorithm change, which produces a hash which is not backwards compatible. This is documented on [this PR on the C library](https://github.com/P-H-C/phc-winner-argon2/pull/115). This was a regrettable requirement to address a security concern in the algorithm itself. +The second of these is that the reference Argon2 implementation introduced an algorithm change, which produces a hash which is not backwards compatible. This is documented on [this PR on the C library](https://github.com/P-H-C/phc-winner-argon2/pull/115). This was a regrettable requirement to address a security concern in the algorithm itself. The two versions of the Argon2 algorithm are numbered 1.0 and 1.3 respectively. -As the crypt format did not change, there is no simple way to identify an original, or improved hash. To support existing users, I'll be maintaining the 0.1.x branch with patches and bugfixes for the immediate future. +Shortly after this, version 1.0.0 of this gem was released with this breaking change, supporting only Argon2 v1.3. Further time later, the official encoding format was updated, with a spec that included the version number, and the library introduced backward compatibility. This should remove the likelyhood of such breaking changes in future. Version 1.1.0 will silently introduce the current version number in hashes, in order to avoid a further compatibility break. + ## Platform Issues The default installation workflow has caused issues with a number of gems under the latest OSX. There is some excellent documentation on the issue and some workarounds in the [Jekyll Documentation](http://jekyllrb.com/docs/troubleshooting/#jekyll-amp-mac-os-x-1011). With this in mind, OSX is a fully supported OS.