e284227557
Argon2's PHC string embeds m, t and p, so verification uses the parameters stored with each account rather than the configured ones -- and verify is the hot path. CheckPassword only rehashed when the ALGORITHM changed, never when its cost parameters did, so changing the defaults reached nobody on an established shard and the change was cosmetic. IPasswordProtection.NeedsRehash defaults to false, leaving PBKDF2 and the HashAlgorithm protections untouched; only Argon2 carries cost in its stored value. Logged at Debug because a restart migrates the whole population at once. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
15 lines
611 B
C#
15 lines
611 B
C#
namespace Server.Accounting
|
|
{
|
|
public interface IPasswordProtection
|
|
{
|
|
string EncryptPassword(string plainPassword);
|
|
bool ValidatePassword(string encryptedPassword, string plainPassword);
|
|
|
|
/// <summary>
|
|
/// True when <paramref name="encryptedPassword"/> was produced with parameters that differ
|
|
/// from the ones this protection currently uses, so a successful login should rewrite it.
|
|
/// Algorithms whose cost is not embedded in the stored value never need this.
|
|
/// </summary>
|
|
bool NeedsRehash(string encryptedPassword) => false;
|
|
}
|
|
}
|