argon2id | Argon2id password hashing and verification for Go | Cryptography library

I'm using Bouncy Castle to implement Argon2id as it allows to set the parameters and salt instead of parsing the output.

The below full running program uses 4 parameter sets - the parameter were taken from PHP's OpenSSL implementation but you can choose the parameter individually of course.

As the program is taken from a Cross platform project it uses a fixed salt that is UNSECURE - in production you need to use a randomly generated salt.

This is an output:

Since no programming language is mentioned, I'm going to give a general answer:

The last "encoded" part is the Base64 representation of the password hash (your hex string). One has to convert the hex representation into bytes and encode those into Base64.

Maybe this Hex-To-Base64-Converter is helpful: https://cryptii.com/pipes/base64-to-hex

You need to implement your own login module, sounds scary, but actually it's not.

1. Find out which version of Picketbox you're Wildfly is bundled with - look in the modules/system/layers/base/org/picketbox/main directory. I.e. for WF 21 the version of Picketbox is 5.0.3.Final
2. Add the Picketbox library as a provided-scoped dependency to your project
3. Implement your custom login module by extending the org.jboss.security.auth.spi.DatabaseServerLoginModule class and overriding the convertRawPassword method - this is where you need to convert the user's input into the Argon2 form
4. Provide the full class name in the code parameter in your login module configuration in standalone.xml. Wildfly will pick it from your deployment and use your implementation instead of the default one.

This should work.

You are close. You need to list the table(s) to delete from. For instance:

From the docs:

You can specify the number of rounds for both bcrypt and argon2 hashing drivers which you can set in your config/hashing.php file

For bcrypt:

This is more about IT security or cryptography, but let's assume that mentioning PHP is enough to perform a small protocol analysis on StackOverflow.

The idea of a salt is that it is unique. That way rainbow tables cannot be constructed and identical passwords cannot be distinguished. A salt is commonly stored with the password hash and should be considered public.

The idea of a pepper is that it remains secret, so that the password hash cannot be created by an attacker that doesn't have access to it. That means that it is impossible for an attacker to guess the password.

Now you've defined a scheme where no salt seems to be used and the pepper is somewhat unique. That's not much good when it isn't; creating 100 rainbow tables seems expensive but feasible, for instance. Furthermore, you will have to store multiple peppers / secrets, rather than just one.

Creating random salts and peppers (both 128 bits) is more secure than your scheme. The HMAC is not needed: you can specify a key for Argon2i. If you cannot, concatenate the salt and pepper and use those as salt (or take the hash over the concatenation and use that, if the salt parameter is limited).

if you look closely at your values (truncated below!), you'll see that the very last single quote is actually a "right single quotation mark" (U+2019) and not a "single quote" / "apostrophe" (U+0027), while all other quotes are apostrophe, as they should be.

I would suggest to use JMSSerializerBundle for that. It is a widely used bundle, also in huge API's. You can exactly configure which properties should be exposed and which not. You can also build groups for exposing properties and use a specific exclusion strategy. Check the documentation for further information.

Hint: also check the Limiting serialization depth for deep nested objects.

Suppose you have multiple providers all implementing UserProviderInterface. When you type hint against the interface, which service do you want injected and how would the container know? The container does not know anything about your firewalls so it can't guess that you want the chain provider. So things worked when you only had one provider but will fail when you have multiple providers.

The same question arises anytime you have multiple implementations of the same interface. You either need to typehint against a specific implementation or inject the desired service manually or create an alias which will tie the interface to one specific implementation.

In your case: