argon2 password hash consumes too much memory #6660

New Issue

GiteaMirror · 2025-11-02T07:02:55-06:00

GiteaMirror commented

2025-11-02 07:02:55 -06:00

Originally created by @6543 on GitHub (Jan 10, 2021).

In current config it takes 64M for one hashing.

Wee need a less resource hungry default algo.

cc @kaepora @zeripath

refs:

Originally created by @6543 on GitHub (Jan 10, 2021). In current config it takes 64M for one hashing. Wee need a less resource hungry default algo. cc @kaepora @zeripath refs: * https://github.com/go-gitea/gitea/pull/10602 * https://github.com/go-gitea/gitea/pull/12688

GiteaMirror added the performance/memory type/docs labels 2025-11-02 07:02:55 -06:00

GiteaMirror closed this issue

2025-11-02 07:02:56 -06:00

GiteaMirror commented

2025-11-02 07:02:57 -06:00

@zeripath commented on GitHub (Jan 10, 2021):

Thinking on I think leaving argon2 as the default is OK - however we should ensure that Users can set it on the install page. (and there is appropriate warning next to the option so our low resource/heavy load Users can choose something different.)

Leaving ourselves in a secure state by default is helpful.

@zeripath commented on GitHub (Jan 10, 2021): Thinking on I think leaving argon2 as the default is OK - however we should ensure that Users can set it on the install page. (and there is appropriate warning next to the option so our low resource/heavy load Users can choose something different.) Leaving ourselves in a secure state by default is helpful.

GiteaMirror commented

2025-11-02 07:02:57 -06:00

@lafriks commented on GitHub (Jan 10, 2021):

I agree with @zeripath on this

@lafriks commented on GitHub (Jan 10, 2021): I agree with @zeripath on this

GiteaMirror commented

2025-11-02 07:02:57 -06:00

@lunny commented on GitHub (Jan 11, 2021):

And we should also update the document with some warning .

@lunny commented on GitHub (Jan 11, 2021): And we should also update the document with some warning .

GiteaMirror commented

2025-11-02 07:02:57 -06:00

@lunny commented on GitHub (Feb 8, 2021):

A PR is needed to add an option on installation page with warning or we should change the default password hash algorithm. Since most Gitea users have small memory instance, this is very important for them.

@lunny commented on GitHub (Feb 8, 2021): A PR is needed to add an option on installation page with warning or we should change the default password hash algorithm. Since most Gitea users have small memory instance, this is very important for them.

GiteaMirror commented

2025-11-02 07:02:57 -06:00

@zeripath commented on GitHub (Feb 11, 2021):

Having spent even more time dealing with more issues that have essentially come down to argon2 I have changed my mind on the above comment.

I now think we should just change it.

Our users cannot really be expected to think that their memory problems and slow downs are due to a password hashing algorithm.

@zeripath commented on GitHub (Feb 11, 2021): Having spent even more time dealing with more issues that have essentially come down to argon2 I have changed my mind on the above comment. I now think we should just change it. Our users cannot really be expected to think that their memory problems and slow downs are due to a password hashing algorithm.

GiteaMirror commented

2025-11-02 07:02:58 -06:00

@zeripath commented on GitHub (Feb 11, 2021):

I guess the question is what should be the default? I guess we just move back to pbkdf2 but make it settable on the install page with warnings about the issues.

@zeripath commented on GitHub (Feb 11, 2021): I guess the question is what should be the default? I guess we just move back to pbkdf2 but make it settable on the install page with warnings about the issues.

GiteaMirror commented

2025-11-02 07:02:58 -06:00

@vladionescu commented on GitHub (Mar 4, 2021):

What issues have we seen from this memory usage? I personally haven't encountered slowdowns, but my instance only has ~20 users so I am certainly not running a very busy Gitea.

Like a good KDF, Argon2 is designed to not be performant. If it was performant, it would be easy for attackers to brute force plaintext passwords should they ever get their hands on the hashes.

That said, it's also not meant to be a drag on the whole system. It has configurable parameters that influence memory usage, among other things. Have we considered tweaking those knobs or exposing them to admins, so they can be turned down for more resource constrained deployments?

@vladionescu commented on GitHub (Mar 4, 2021): What issues have we seen from this memory usage? I personally haven't encountered slowdowns, but my instance only has ~20 users so I am certainly not running a very busy Gitea. Like a good KDF, Argon2 is designed to not be performant. If it was performant, it would be easy for attackers to brute force plaintext passwords should they ever get their hands on the hashes. That said, it's also not meant to be a drag on the whole system. It has configurable parameters that influence memory usage, among other things. Have we considered tweaking those knobs or exposing them to admins, so they can be turned down for more resource constrained deployments?

GiteaMirror commented

2025-11-02 07:02:58 -06:00

@jolheiser commented on GitHub (Mar 4, 2021):

Further discussion can be moved over to https://github.com/go-gitea/gitea/issues/14702 instead of a closed issue. 🙂

@jolheiser commented on GitHub (Mar 4, 2021): Further discussion can be moved over to https://github.com/go-gitea/gitea/issues/14702 instead of a closed issue. 🙂

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#6660