supabase / auth / 12480890424

69%

push

github

feat: fix argon2 parsing and comparison (#1887)

Argon2 parsing and comparison is broken in multiple ways:

1. Incorrect comparison being done using `ConstantTimeCompare`. This Go
API is awful as it returns 1 on _equality_ (unlike all other comparison
APIs that return 0) so it was missed.
2. All Argon2 comparisons were producing incorrect derived keys due to
the multiplication by 1024. The `argon2.Key` and `IDKey` accept *KiB* as
arguments (not bytes!) which caused all hashes to always be incorrect.

Tests didn't catch this as they only tested for the positive case (which
passed with flying colors).

16 of 20 new or added lines in 1 file covered. (80.0%)

9742 of 16976 relevant lines covered (57.39%)

55.79 hits per line