Class PepperRing

Namespace

Argon2id.PasswordHasher

Assembly

Argon2id.PasswordHasher.dll

A set of peppers comprising one Active pepper (used for new hashes) and zero or more retired peppers (still accepted when verifying older hashes). This is the unit that gives Argon2id peppering a safe rotation story.

public sealed class PepperRing

Inheritance

object

PepperRing

Remarks

To rotate: construct a new ring whose Active pepper is the new key and whose retired list contains the previous key(s). Existing hashes keep verifying with their original pepper, and NeedsRehash(string) reports that they should be upgraded to the active pepper on the next successful login.

Constructors

PepperRing(Pepper, params Pepper[])

Creates a pepper ring.

public PepperRing(Pepper active, params Pepper[] retired)

Parameters

active Pepper

The pepper used to produce new hashes.

retired Pepper[]

Previously active peppers that must still verify existing hashes. Their ids must be distinct from each other and from active.

Exceptions

ArgumentNullException

active is null.

ArgumentException

Two peppers share the same Id.

Properties

Active

The pepper used when producing new hashes.

public Pepper Active { get; }

Property Value

Pepper