Re: [Cfrg] draft-irtf-cfrg-argon2 variable-length hash function size

Hi,

I implemented Argon2i for Monocypher, and checked that it does the same
as Libsodium.

I can confirm you want the output of the extended hash to cover 1024
bytes. H'(1024) indeed.

Loup.

On Wed, 2020-05-20 at 14:58 -0700, Matthew Endsley wrote:
> While implementing argon2 from draft-10, I either incorrectly
> interpreted a section or there is an error describing the variable-
> length hash function H'.
> 
> Section 3.2 lists the operations to perform the Argon2 hash.
> 
> This describes the hash function H^x() having an output size of x
> bytes.
> 
> Steps 3 and 4 calculate the initial blocks B[i][0] and B[i][1] as the
> result of the variable length hash H'^(128).
> 
> I believe this is supposed to be H'^(1024) as the intent is to fill
> the entire 1kib block. Using H'^(128) only fills 128 bytes, and
> generates the incorrect values for the test vectors. H'^(1024) fills
> the entire block and generates the correct values for the test
> vectors.
> 
> Matt
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg