blob: 6935e913cbcb967713f750b2a4993a2a05a35b57 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
|
# Vendored third-party assets
The SPA is served under a CSP that forbids every external host, so anything it
uses has to live here. Each entry records exactly what was taken and from where,
so it can be checked or rebuilt without guesswork.
## argon2.min.js
| | |
|---|---|
| Package | `argon2-browser` 1.18.0 (npm) |
| Source | https://registry.npmjs.org/argon2-browser/-/argon2-browser-1.18.0.tgz |
| Tarball sha256 | `cdb11795a4971bde095fe6b836aa424de50c4558ed4b9505bc74111eee7f6d35` |
| Tarball sha1 (npm dist.shasum) | `f35820211e0a431aed7f82b9348477234be69bec` |
| File taken | `package/dist/argon2-bundled.min.js` |
| File sha256 | `77c64b946baf1a5116dc591f4b9965d636b1b455f75edd2d4a587cb75e01687b` |
The bundled build carries the WebAssembly inline as base64, so there is no second
request and nothing to locate at runtime.
**Why it is here at all:** WebCrypto has no memory-hard KDF. The encrypted
keypair bundle is protected by the passphrase alone and rests on every node whose
group its owner joins (finding C4), so PBKDF2 — compute-only, and therefore cheap
on a GPU — was the wrong tool for it. Measured through this build on the dev
machine: Argon2id 128 MB / t=3 / p=1 takes ~640 ms, against ~240 ms for
PBKDF2-SHA512 at 600k, for a memory cost a GPU cannot ignore.
### argon2.wasm
The same build's standalone WebAssembly, sha256
`0c2149886c13e4eae4a6ca25ee71d47423c5c8740a874cf04ff816d1b2c901d7`.
The browser never requests it — `argon2.min.js` carries the same bytes inline as
a data URL. It is kept because the cross-language parity test drives the vendored
library under node, where the emscripten loader takes its file path instead of the
inline copy, and a test that cannot run is a test that stops being true.
|