fix(core): reduce hashing security for low-end routers compatibility

Author: maksimkurb

docs/content/docs/rest-api.md

@@ -22,7 +22,7 @@ The REST API is available when:
     "listen": "0.0.0.0:12121",
     "authentication": {
       "enabled": true,
-      "password_hash": "argon2id$v=19$m=19456,t=2,p=1$..."
+      "password_hash": "argon2id$v=19$m=2048,t=2,p=1$..."
     },
     "cors": {
       "allowed_origins": ["https://panel.example.com"]

docs/content/docs/rest-api.ru.md

@@ -22,7 +22,7 @@ REST API доступен, если:
     "listen": "0.0.0.0:12121",
     "authentication": {
       "enabled": true,
-      "password_hash": "argon2id$v=19$m=19456,t=2,p=1$..."
+      "password_hash": "argon2id$v=19$m=2048,t=2,p=1$..."
     },
     "cors": {
       "allowed_origins": ["https://panel.example.com"]

src/auth/password.cpp

@@ -18,15 +18,17 @@ namespace {
 using Salt = std::array<std::uint8_t, 16>;
 using Digest = std::array<std::uint8_t, 32>;
 
-constexpr std::uint32_t kArgon2MemoryBlocks = 19'456; // 19 MiB
+constexpr std::uint32_t kArgon2MemoryBlocks = 2'048; // 2 MiB
 constexpr std::uint32_t kArgon2Passes = 2;
 constexpr std::uint32_t kArgon2Lanes = 1;
-constexpr std::string_view kVerifierPrefix = "argon2id$v=19$m=19456,t=2,p=1$";
+constexpr std::string_view kVerifierPrefix = "argon2id$v=19$m=2048,t=2,p=1$";
 constexpr char kHex[] = "0123456789abcdef";
 
 struct Argon2WorkArea {
-    std::vector<std::uint64_t> words = std::vector<std::uint64_t>(
-        static_cast<std::size_t>(kArgon2MemoryBlocks) * 1024 / sizeof(std::uint64_t));
+    Argon2WorkArea()
+        : words(static_cast<std::size_t>(kArgon2MemoryBlocks) * 1024 / sizeof(std::uint64_t)) {}
+
+    std::vector<std::uint64_t> words;
 
     ~Argon2WorkArea() {
         crypto_wipe(words.data(), words.size() * sizeof(std::uint64_t));

tests/test_api_auth.cpp

@@ -11,14 +11,15 @@ namespace keen_pbr3 {
 
 TEST_CASE("Argon2id password verifiers validate and reject other passwords") {
     const auto verifier = auth::generate_password_hash("correct horse");
-    CHECK(verifier.rfind("argon2id$v=19$m=19456,t=2,p=1$", 0) == 0);
+    CHECK(verifier.rfind("argon2id$v=19$m=2048,t=2,p=1$", 0) == 0);
     CHECK(auth::valid_password_hash(verifier));
     CHECK(auth::verify_password("correct horse", verifier));
     CHECK_FALSE(auth::verify_password("wrong", verifier));
+    CHECK_FALSE(auth::valid_password_hash("argon2id$v=19$m=19456,t=2,p=1$"));
     CHECK_FALSE(auth::valid_password_hash("sha256$invalid"));
     CHECK_FALSE(auth::valid_password_hash("pbkdf2-sha256$200000$legacy$verifier"));
     auto modified = verifier;
-    modified.replace(modified.find("m=19456"), 7, "m=32768");
+    modified.replace(modified.find("m=2048"), 6, "m=32768");
     CHECK_FALSE(auth::valid_password_hash(modified));
 }