gbrodman b1266c95e8 Add and default to Argon2 hashing (#2877) ...

We've previously been using Scrypt since PR #2191 which, while being a
memory-hard slow function, isn't the optimal solution according to the
OWASP recommendations. While we could get away with increasing the
parallelization parameter to 3, it's better to just switch to the
most-recommended solution if we're switching things up anyway.

For the transition, we do something similar to PR #2191 where if the
previous-algorithm's hash is successful, we re-hash with Argo2id and
store that version. By doing this, we should not need any intervention
for registrars who log in at any point during the transition period.

Much of this PR, especially the parts where we re-hash the passwords in
Argon2 instead of Scrypt upon login, is based on the code that was
eventually removed in #2310.

2025-11-17 20:11:22 +00:00

..

src

Add and default to Argon2 hashing (#2877)

2025-11-17 20:11:22 +00:00

build.gradle

Remove old console soy/js and related files (#2861)

2025-10-28 20:34:34 +00:00

buildscript-gradle.lockfile

Update Flyway versions to 11.x+ (#2620)

2024-12-10 03:02:02 +00:00

Dockerfile

Update runtime to Java 21 (#2353)

2024-03-06 15:10:11 +00:00

gradle.lockfile

Tag more junit versions to <6.0 (#2809)

2025-08-22 02:55:59 +00:00