Smart ID Identity Manager uses Argon2id to hash user passwords, which provides higher resistance against GPU-based attacks by being memory-hard.
You can customize several algorithm parameters to balance security with resource consumption (CPU/memory). The default values are chosen based on the defaults of Spring-Security 5.8+ and recommendations by the Open Worldwide Application Security Project (OWASP), as of end of August 2023, with some differences:
| Parameter | Identity Manager default | Notes |
|---|
| salt length | 16 bytes | Spring default, according to the Argon2 spec sufficient for all applications. |
| hash length / tag length | 32 bytes | Spring default, twice of what the Argon2 spec considers sufficient for most applications. |
| parallelism | 1 | Threads/lanes used during a single hashing operation. Servers should stick to a value of 1. For more information, see this post by Steve Thomas from OWASP. Furthermore, Spring-Security's underlying implementation in BouncyCastle is single-threaded, so higher values would only favor an attacker. |
| memory | 7.168 KiB | Memory required per password hashing/verification (here: ~146 concurrent operations per 1 GiB of memory). Higher values can slow down the operation slightly, a side-effect of managing more memory. |
| iterations | 10 | Higher values slow down the hashing/verification and increases the CPU usage. Doubled OWASP recommendation, as the Argon2 values given correspond to a BCrypt work factor of only ~9. For more information, see this post by Steve Thomas from OWASP. The login speed is still faster than BCrypt, at least using the Spring-Security implementations. |
Configure Docker-based deployments
- Open the following files:
- docker\compose\identitymanager\admin\docker-compose.yml
- docker\compose\identitymanager\operator\docker-compose.yml
- docker\compose\identitymanager\tenant\docker-compose.yml
- Define SYSTEM_PROPERTIES with the desired values in the
environment section of the files, for example:
environment:
- 'SYSTEM_PROPERTIES={
"argon2PwEncoderFactory.saltLength ": "16",
"argon2PwEncoderFactory.hashLength": "32",
"argon2PwEncoderFactory.parallelism": "1",
"argon2PwEncoderFactory.memory": "19456",
"argon2PwEncoderFactory.iterations": "4",
...other properties...
}'
...other env vars...
Configure WAR file deployment
- Edit WEB-INF\classes\system.properties in your Identity Manager Admin, Operator, or Tenant web applications and set the desired values, for example:
argon2PwEncoderFactory.saltLength = 16
argon2PwEncoderFactory.hashLength = 32
argon2PwEncoderFactory.parallelism = 1
argon2PwEncoderFactory.memory = 19456
argon2PwEncoderFactory.iterations = 4
