Bug #90612: Upgrading from 8 to 9 choosing Argon2i throws error - TYPO3 Core - TYPO3 Forge

Actions

Copy link

Bug #90612

closed

Upgrading from 8 to 9 choosing Argon2i throws error

Added by Claus Harup about 4 years ago. Updated about 4 years ago.

Status:

Closed

Priority:

Should have

Assignee:

Category:

Backend API

Target version:

next-patchlevel

Start date:

2020-03-02

Due date:

% Done:

100%

Estimated time:

TYPO3 Version:

PHP Version:

7.4

Tags:

Complexity:

Is Regression:

Sprint Focus:

Description

Upgrading from 8 to 9 choosing Argon2i - Running on PHP 7.4.3 - gives me this on be login:

PHP Warning: password_needs_rehash(): A thread value other than 1 is not supported by this implementation in /var/www/typo3_source/typo3_src-9.5.14/typo3/sysext/core/Classes/Crypto/PasswordHashing/Argon2iPasswordHash.php line 144

The property is defined as:

protected $options = [ 'memory_cost' => 65536, 'time_cost' => 16, 'threads' => 2 ];

Setting: $GLOBALS['TYPO3_CONF_VARS']['BE']['passwordHashing']['options']['threads'] = 1; solves the issue, but I have a hard time understanding why 'threads' => 2 in the core?

Files

Annotation 2020-03-04 085038.png (125 KB) Annotation 2020-03-04 085038.png

Claus Harup, 2020-03-04 08:50

Actions

Copy link

Updated by Christian Eßl about 4 years ago

TYPO3 is using libargon and should be testing for the presence of this library in the Install Tool by checking if the constant PASSWORD_ARGON2I is set. Does the Install Tool tell you that ARGON2I is supported? Because it looks like your PHP is missing the library.

The error you reported comes from libsodium, which has a different argon2i implementation that is locked to only 1 supported thread. Right now, TYPO3 does not support argon2i via libsodium and AFAIK it shouldn't be possible to select it from the Install Tool. (Although it still is possible to set up the website on a different system with libargon and then deploying it to a webserver without the support.)

The support of argon2 via libsodium in PHP is younger than the libargon one. (And that's probably why it is missing for TYPO3) Maybe it can be thought about supporting both implementations in TYPO3?

Actions

Copy link

Updated by Claus Harup about 4 years ago

File Annotation 2020-03-04 085038.png Annotation 2020-03-04 085038.png added

You are correct - my PHP settings:

sodium support enabled
libsodium headers version 1.0.18
libsodium library version 1.0.18

The InstallTool lets me choose Argon2i - see attached image

Actions

Copy link

Updated by Gerrit Code Review about 4 years ago

Status changed from New to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/63605

Actions

Copy link

Updated by Gerrit Code Review about 4 years ago

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/63605

Actions

Copy link

Updated by Gerrit Code Review about 4 years ago

Patch set 1 for branch 9.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/63852

Actions

Copy link

Updated by Gerrit Code Review about 4 years ago

Patch set 2 for branch 9.5 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/63852

Actions

Copy link