Skill Wiki
Hash Passwords With Argon2 Or Bcrypt
User passwords must be stored using a deliberately slow, salted, adaptive hash designed for password storage: argon2id (preferred), scrypt, or bcrypt.…
$ prime install @security/rule-hash-passwords-with-argon2-or-bcryptProjection
Always in _index.xml · the agent never has to ask for this.
HashPasswordsWithArgon2OrBcrypt [rule] v0.1.0
User passwords must be stored using a deliberately slow, salted, adaptive hash designed for password storage: argon2id (preferred), scrypt, or bcrypt. General-purpose hashes (MD5, SHA-1, SHA-256, SHA-512) are forbidden — even with salt, they are too fast and yield to GPU/ASIC brute force.
Loaded when retrieval picks the atom as adjacent / supporting.
HashPasswordsWithArgon2OrBcrypt [rule] v0.1.0
User passwords must be stored using a deliberately slow, salted, adaptive hash designed for password storage: argon2id (preferred), scrypt, or bcrypt. General-purpose hashes (MD5, SHA-1, SHA-256, SHA-512) are forbidden — even with salt, they are too fast and yield to GPU/ASIC brute force.
Checks
- argon2id with memory ≥ 19 MiB, iterations ≥ 2, parallelism ≥ 1 (OWASP minimum); tune upward to stay around 0.5–1s per hash on production hardware.
- bcrypt cost factor ≥ 10 (12+ for new systems); password input pre-hashed with SHA-256 only if length > 72 bytes.
- Per-user random salt ≥ 16 bytes generated by a CSPRNG; stored alongside the hash.
- No use of SHA-1, MD5, plain SHA-2, or unsalted hashes for password storage.
- Verification path uses constant-time comparison.
Label
Store passwords with a memory-hard adaptive hash
Loaded when retrieval picks the atom as a focal / direct hit.
HashPasswordsWithArgon2OrBcrypt [rule] v0.1.0
User passwords must be stored using a deliberately slow, salted, adaptive hash designed for password storage: argon2id (preferred), scrypt, or bcrypt. General-purpose hashes (MD5, SHA-1, SHA-256, SHA-512) are forbidden — even with salt, they are too fast and yield to GPU/ASIC brute force.
Checks
- argon2id with memory ≥ 19 MiB, iterations ≥ 2, parallelism ≥ 1 (OWASP minimum); tune upward to stay around 0.5–1s per hash on production hardware.
- bcrypt cost factor ≥ 10 (12+ for new systems); password input pre-hashed with SHA-256 only if length > 72 bytes.
- Per-user random salt ≥ 16 bytes generated by a CSPRNG; stored alongside the hash.
- No use of SHA-1, MD5, plain SHA-2, or unsalted hashes for password storage.
- Verification path uses constant-time comparison.
Label
Store passwords with a memory-hard adaptive hash
Label
Store passwords with a memory-hard adaptive hash
Source
prime-system/examples/security-appsec/primes/compiled/@security/rule-hash-passwords-with-argon2-or-bcrypt/atom.yaml