Add Argon2id from NIST Password Hashing Competion (#1433)
Add Argon2id from NIST Password Hashing Competion (#1433)

* Add Argon2id from NIST Password Hashing Competion

5 years ago, Argon2 won NIST's Password Hashing Competion.
It is included in OWASP's recommendations:
 https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
I think it has seen sufficient experience and vetting to add to this
list.
I also put PBKDF2, which is not memory-hard, at the end of the list.
It seems to still be around until some other algorithm is approved
for FIPS compliance last I heard.

It seems most helpful to name Argon2id specifically since it is called
out in the (still-draft) IETF ID:
 https://tools.ietf.org/html/draft-irtf-cfrg-argon2-10.

Signed-off-by: Neal McBurnett <d50a4528250c5e7ab89d3b057cfa34db7ebf58d4@mcburnett.org>

* Move edits to en.yml; authorization token note

As noted by david-a-wheeler, criteria.md is auto-generated from en.yml.
(Should it even be version-controlled?)

Also changed another place where bcrypt is mentioned.

And there is a comment about passwords for logging in to other sites.
Do we really want to condone that? I've changed it to "authentication tokens",
and guess that oauth or the like might be worth mentioning, but that's a whole
new topic, I guess.

Signed-off-by: Neal McBurnett <d50a4528250c5e7ab89d3b057cfa34db7ebf58d4@mcburnett.org>

* Link to OWASP on Password Storage

Signed-off-by: Neal McBurnett <d50a4528250c5e7ab89d3b057cfa34db7ebf58d4@mcburnett.org>

* List Argon2id first.

Based on "Towards Practical Attacks on Argon2i and Balloon Hashing"
 https://eprint.iacr.org/2016/759.pdf
list Argon2id before Bcrypt, which remains before scrypt
due to side-channel attacks on the latter.
[As if anyone is looking at the order we list them in...]

And note for the record that we're talking about Argon2 version 1.3
(aka Argon2-B in that paper) from 2017, not the original winner
of the PHC.

The state-of-the-art is surprisingly confusing and poorly documented
AFAICT....

Signed-off-by: Neal McBurnett <d50a4528250c5e7ab89d3b057cfa34db7ebf58d4@mcburnett.org>
linuxfoundation/cii-best-practices-badge,linuxfoundation/cii-best-practices-badge,coreinfrastructure/best-practices-badge,coreinfrastructure/best-practices-badge,coreinfrastructure/best-practices-badge,coreinfrastructure/best-practices-badge,linuxfoundation/cii-best-practices-badge,linuxfoundation/cii-best-practices-badge