Usage of weak hashing library on a password (Argon2)

Rule ID: python_lang_weak_password_hash_argon2
Languages: python
Source: weak_password_hash_argon2.yml

Description

Choosing a weak hashing algorithm for passwords compromises security. Argon2 has three variants: Argon2i, Argon2d, and Argon2id. Argon2id is the strongest and most recommended for password hashing because of its balanced resistance against both side-channel and GPU attack vectors.

Remediations

Do not override the Argon2 type when implementing the argon2-cffi hashing library.
```
  ph = PasswordHasher(Type.I) # unsafe
  hash = ph.hash(user.password) 
```
Do rely on the default Argon2 type (Argon2id) as it is the most secure. This ensures the highest level of security for password storage.
```
  ph = PasswordHasher() # defaults to Argon2id
  hash = ph.hash(user.password) 
```

References

Associated CWE

CWE-326: Inadequate Encryption Strength

OWASP Top 10

A02:2021 - Cryptographic Failures

Configuration

To skip this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --skip-rule=python_lang_weak_password_hash_argon2

To run only this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --only-rule=python_lang_weak_password_hash_argon2