Set Argon2id as default KDF

Feature Requests Password Manager
, ,
1

Currently, new Bitwarden accounts default to PBKDF2_SHA256 with 600,000 iterations. Argon2id has been implemented for almost three years now, so it is stable enough to be set as the default and can significantly increasing the level of security of users.

I see 3 ways :

  • Change all hard‑coded PBKDF2 defaults to always use Argon2id
  • Use existing argon2‑default feature flag to toggle between PBKDF2 (default) and Argon2id (and use something like globalSettings__launchDarkly__flagValues__argon2‑default: “true”)
  • Add new globalSettings__defaultKdfType setting (Argon2id/PBKDF2_SHA256)

argon2‑default flag exists (src/Core/Constants.cs:192) but is not used anywhere in the server code. Two last options will need an additionnal variable in the helm chart (maybe pre‑install‑hook‑configmap.yaml).

I’m ok to create an Issue and PR on Github.

2 Likes
2

@r3m8 Welcome to the forum!

Just FYI, there already were some efforts to do that, but for whatever reason the PR is still closed:

3

Thanks, I didn’t check the clients repo.

I see that the linked server PR has already been merged with the argon2-default flag, but as I mentioned, this flag isn’t being used anywhere in the server source code.

Given the many hardcoded PBKDF2 values in the server source, updating the server code would be great.

1 Like
4

If you’re not already familiar with the following notice, this would be your starting point for code contributions:

1 Like
5

This is very much on the team’s radar as something we’d like to do in the future. At present, we do have some concern about the memory limits that iOS imposes on app extensions, which could cause users of the iOS mobile app trouble when trying to autofill if using sensible defaults for Argon2.

2 Likes
6

Thanks for your feedback !

7

So setting it for the memory limits that iOS would be less secure than the current default?