feature #26175 [Security] Add configuration for Argon2i encryption (CoalaJoe)

This PR was merged into the 4.1-dev branch.

Discussion
----------

[Security] Add configuration for Argon2i encryption

| Q             | A
| ------------- | ---
| Branch?       | master
| Bug fix?      | no
| New feature?  | yes
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #26174
| License       | MIT
| Doc PR        | [#9300](symfony/symfony-docs#9300)

Feedback?

Current situation: Configuration only applies if argon2i is natively supported.

Commits
-------

1300fece5f [Security] Add configuration for Argon2i encryption

Author: fabpot

Encoder/Argon2iPasswordEncoder.php

@@ -17,9 +17,30 @@
  * Argon2iPasswordEncoder uses the Argon2i hashing algorithm.
  *
  * @author Zan Baldwin <hello@zanbaldwin.com>
+ * @author Dominik Müller <dominik.mueller@jkweb.ch>
  */
 class Argon2iPasswordEncoder extends BasePasswordEncoder implements SelfSaltingEncoderInterface
 {
+    private $config = array();
+
+    /**
+     * Argon2iPasswordEncoder constructor.
+     *
+     * @param int|null $memoryCost memory usage of the algorithm
+     * @param int|null $timeCost   number of iterations
+     * @param int|null $threads    number of parallel threads
+     */
+    public function __construct(int $memoryCost = null, int $timeCost = null, int $threads = null)
+    {
+        if (\defined('PASSWORD_ARGON2I')) {
+            $this->config = array(
+                'memory_cost' => $memoryCost ?? \PASSWORD_ARGON2_DEFAULT_MEMORY_COST,
+                'time_cost' => $timeCost ?? \PASSWORD_ARGON2_DEFAULT_TIME_COST,
+                'threads' => $threads ?? \PASSWORD_ARGON2_DEFAULT_THREADS,
+            );
+        }
+    }
+
     public static function isSupported()
     {
         if (\defined('PASSWORD_ARGON2I')) {
@@ -81,7 +102,7 @@ public function isPasswordValid($encoded, $raw, $salt)
 
     private function encodePasswordNative($raw)
     {
-        return password_hash($raw, \PASSWORD_ARGON2I);
+        return password_hash($raw, \PASSWORD_ARGON2I, $this->config);
     }
 
     private function encodePasswordSodiumFunction($raw)

Encoder/EncoderFactory.php

@@ -111,7 +111,11 @@ private function getEncoderConfigFromAlgorithm($config)
             case 'argon2i':
                 return array(
                     'class' => Argon2iPasswordEncoder::class,
-                    'arguments' => array(),
+                    'arguments' => array(
+                        $config['memory_cost'],
+                        $config['time_cost'],
+                        $config['threads'],
+                    ),
                 );
         }
 

Tests/Encoder/Argon2iPasswordEncoderTest.php

@@ -28,6 +28,14 @@ protected function setUp()
         }
     }
 
+    public function testValidationWithConfig()
+    {
+        $encoder = new Argon2iPasswordEncoder(4, 4, 1);
+        $result = $encoder->encodePassword(self::PASSWORD, null);
+        $this->assertTrue($encoder->isPasswordValid($result, self::PASSWORD, null));
+        $this->assertFalse($encoder->isPasswordValid($result, 'anotherPassword', null));
+    }
+
     public function testValidation()
     {
         $encoder = new Argon2iPasswordEncoder();