Re: State of Argon2 support

[Nikolaos Chatzikonstantinou]

On Mon, Jan 1, 2024 at 2:48 PM Patrick Steinhardt <ps@pks.im> wrote:
>
> On Fri, Dec 22, 2023 at 09:43:35PM -0600, Oskari Pirhonen wrote:
> > On Fri, Dec 22, 2023 at 12:29:22 -0500, Nikolaos Chatzikonstantinou wrote:
> > > 2. libgcrypt does not have support for Argon2. Possible solution is to
> > > use the reference implementation, licensed under CC0. This is bringing
> > > up issues (that I don't fully understand), would be preferable if the
> > > authors released under GPLv3. Has there been a follow-up on this?
> > > <https://lists.gnu.org/archive/html/grub-devel/2020-03/msg00170.html>
> > >
> >
> > Libgcrypt supports Argon2 as of 1.10 (March 2022). The version of
> > libgcrypt that is bundled with GRUB is older than that.
>
> Indeed. There are two different ways to implement Argon2 support in
> GRUB:
>
>   - Use the reference implementation of Argon2.
>
>   - Update libgcrypt to a newer version.
>
> Problem is that upgrading the bundled libgcrypt library is not trivial
> at all. I've tried multiple times, and every single time I quickly gave
> up. There's simply too many things that have changed, and GRUB does have
> quite a lot of patches on top of the current bundled version of the
> library. Regardless of that it would be the right thing to do, because
> in the long run we do want an up-to-date version of libgrcypt regardless
> of Argon2 support anyway.

That is interesting! Maybe I can give it a try.

It seems to me that my game plan is to find the two versions of
libgcrypt (old and new) and read the NEWS file carefully for how to
migrate.

Regards,
Nikolaos Chatzikonstantinou