diff options
Diffstat (limited to 'CLAUDE.md')
| -rw-r--r-- | CLAUDE.md | 13 |
1 files changed, 9 insertions, 4 deletions
@@ -210,7 +210,8 @@ These are about working on the tree rather than about the design: having a bad day. `mail.send_off_loop` is the door, and `test_no_mail_is_sent_from_the_event_loop` reads the source for direct calls, because there is nothing else to read. **Argon2 is the same, with a trap - under it**: one derivation is 256 MB and ~0.25–0.5 s, so it goes through + under it**: one derivation is 64 MiB and ~0.1 s on meshbay.org (0.45 s at the + 256 MB of `pw_version` 3, still paid once per old account), so it goes through `auth.hash_password_off_loop` / `verify_password_off_loop` — but **two concurrent `lanes=4` derivations deadlock inside OpenSSL** and never return, at no CPU (cryptography 50.0.x, OpenSSL 4.0.x, reproduced locally and on @@ -723,9 +724,13 @@ older one wins by being read first. ## Known calibration TODOs -- Argon2id `memory_cost`: ✅ DONE — bumped to 262144 (256 MB) in pw_version=2. - Existing v1 users (64 MB) are transparently rehashed on next successful login. - CLI `calibrate` command still TODO for per-hardware tuning. +- Hub Argon2id verifier: **64 MiB, t=3, lanes=4 in `pw_version` 4** — why not + more is `docs/MESHBAY_DESIGN.md` §4.6. Older `auth_key` hashes (v3, 256 MB) + are rewritten on next sign-in; legacy raw-password hashes stay at v2. + **`hash_password` takes the version being stored** — hashing at one version's + parameters and recording another locks the account out, which went unseen + while v2 and v3 shared parameters. CLI `calibrate` still TODO for per-hardware + tuning. ## NAT traversal |