[SEC-18095] Add an optional version parameter in HashPassword wrappers

Author: sduquette-devolutions

Cargo.lock

@@ -1,5 +1,5 @@
 [workspace]
-package.version = "0.10.0"
+package.version = "0.10.1"
 members = [
   "cli",
   "ffi",
@@ -20,7 +20,7 @@ rust-argon2 = { version = "3.0", default-features = false }
 [package]
 name = "devolutions-crypto"
 version.workspace = true
-authors = ["Philippe Dugre <pdugre@devolutions.net>", "Mathieu Morrissette <mmorrissette@devolutions.net>"]
+authors = ["Mathieu Morrissette <mmorrissette@devolutions.net>", "Sebastien Duquette <sduquette@devolutions.net>"]
 edition = "2021"
 readme = "README_RUST.md"
 license = "MIT OR Apache-2.0"

Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "devolutions-crypto-cli"
 version.workspace = true
-authors = ["Philippe Dugre <pdugre@devolutions.net>"]
+authors = ["Devolutions <network@devolutions.net>"]
 edition = "2018"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

cli/Cargo.toml

@@ -6,7 +6,7 @@ use std::{borrow::Borrow, convert::TryFrom};
 #[derive(Debug, Parser)]
 #[command(name = "devolutions-crypto-cli")]
 #[command(version = env!("CARGO_PKG_VERSION"))]
-#[command(author = "Philippe Dugre <pdugre@devolutions.net>")]
+#[command(author = "Devolutions <network@devolutions.net>")]
 struct Cli {
     #[command(subcommand)]
     command: Commands,

cli/src/main.rs

@@ -7,8 +7,6 @@ edition = "2021"
 name = "devolutions_crypto_ffi"
 crate-type = ["cdylib", "staticlib"]
 
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
 [dependencies]
 devolutions-crypto = { path = "../" }
 zeroize = "1"

ffi/Cargo.toml

@@ -55,6 +55,10 @@ use zeroize::Zeroizing;
 
 const VERSION: &str = env!("CARGO_PKG_VERSION");
 
+pub const PASSWORD_HASH_LATEST: u16 = 0;
+pub const PASSWORD_HASH_V1: u16 = 1;
+pub const PASSWORD_HASH_V2: u16 = 1;
+
 /// Encrypt a data blob
 /// # Arguments
 ///  * `data` - Pointer to the data to encrypt.
@@ -744,6 +748,7 @@ pub extern "C" fn SignSize(_version: u16) -> i64 {
 ///  * `result` - Pointer to the buffer to write the hash to.
 ///  * `result_length` - Length of the buffer to write the hash to. You can get the value by
 ///                         calling HashPasswordLength() beforehand.
+///  * `version` - Version to use. Use PASSWORD_HASH_LATEST for the latest one.
 /// # Returns
 /// This returns the length of the hash. If there is an error, it will return the
 ///     appropriate error code defined in DevoCryptoError.
@@ -755,19 +760,25 @@ pub unsafe extern "C" fn HashPassword(
     password_length: usize,
     result: *mut u8,
     result_length: usize,
+    version: u16,
 ) -> i64 {
     if password.is_null() || result.is_null() {
         return Error::NullPointer.error_code();
     };
 
-    if result_length != HashPasswordLength() as usize {
+    let version = match PasswordHashVersion::try_from(version) {
+        Ok(v) => v,
+        Err(_) => return Error::UnknownVersion.error_code(),
+    };
+
+    if result_length != HashPasswordLength(version as u16) as usize {
         return Error::InvalidOutputLength.error_code();
     };
 
     let password = slice::from_raw_parts(password, password_length);
     let result = slice::from_raw_parts_mut(result, result_length);
 
-    let res: Zeroizing<Vec<u8>> = match hash_password(password, PasswordHashVersion::Latest) {
+    let res: Zeroizing<Vec<u8>> = match hash_password(password, version) {
         Ok(x) => Zeroizing::new(x.into()),
         Err(e) => return e.error_code(),
     };
@@ -778,17 +789,19 @@ pub unsafe extern "C" fn HashPassword(
 }
 
 /// Returns the length of the hash to input as `result_length` in `HashPassword()`.
-/// The size reflects the default Argon2id parameters.
+/// # Arguments
+///  * `version` - Version to use. Use 0 for the latest one.
 /// # Returns
-/// Returns the length of the hash.
+/// Returns the length of the hash, or a negative error code for an unknown version.
 #[no_mangle]
-pub extern "C" fn HashPasswordLength() -> i64 {
-    // 8 (PasswordHash header)
-    // + 4 (u32 params_len)
-    // + 8 (DerivationParameters header)
-    // + GetDefaultArgon2ParametersSize() (Argon2Parameters default)
-    // + 32 (Argon2 default output length)
-    8 + 4 + 8 + GetDefaultArgon2ParametersSize() + 32
+pub extern "C" fn HashPasswordLength(version: u16) -> i64 {
+    match version {
+        // V1: PBKDF2 — fixed layout: 4 (iterations) + 32 (salt) + 32 (hash) = 68, plus 8-byte header
+        1 => 8 + 68,
+        // V2 / Latest: Argon2id — header + params_len field + DerivationParameters + hash
+        0 | 2 => 8 + 4 + 8 + GetDefaultArgon2ParametersSize() + 32,
+        _ => Error::UnknownVersion.error_code(),
+    }
 }
 
 /// Hash a password using caller-supplied serialized [`DerivationParameters`].
@@ -2419,8 +2432,8 @@ fn test_hash_password_length() {
         .unwrap()
         .into();
 
-    assert_eq!(HashPasswordLength() as usize, small_password_hash.len());
-    assert_eq!(HashPasswordLength() as usize, long_password_hash.len());
+    assert_eq!(HashPasswordLength(PASSWORD_HASH_LATEST) as usize, small_password_hash.len());
+    assert_eq!(HashPasswordLength(PASSWORD_HASH_LATEST) as usize, long_password_hash.len());
 }
 
 #[test]

ffi/src/lib.rs

@@ -1,11 +1,11 @@
 [project]
 name = "devolutions-crypto"
-version = "2026.6.16"
+version = "2026.6.22"
 description = "An abstraction layer for the cryptography used by Devolutions"
 readme = "PYPI_README.md"
 authors = [
-    { name = "Philippe Dugre", email = "pdugre@devolutions.net" },
-    { name = "Mathieu Morrissette", email = "mmorrissette@devolutions.net" }
+    { name = "Mathieu Morrissette", email = "mmorrissette@devolutions.net" },
+    { name = "Sebastien Duquette", email = "sduquette@devolutions.net" },
 ]
 license = { text = "MIT OR Apache-2.0" }
 requires-python = ">=3.10"

python/pyproject.toml

@@ -54,6 +54,27 @@ public enum DataType
         KdfEncryptedData = 9
     }
 
+    /// <summary>
+    /// Devolutions Crypto Password Hash Version.
+    /// </summary>
+    public enum PasswordHashVersion
+    {
+        /// <summary>
+        /// This is the latest version. (Currently Argon2id)
+        /// </summary>
+        Latest = 0,
+
+        /// <summary>
+        /// PBKDF2-HMAC-SHA256.
+        /// </summary>
+        V1 = 1,
+
+        /// <summary>
+        /// Argon2id.
+        /// </summary>
+        V2 = 2,
+    }
+
     /// <summary>
     /// Devolutions Crypto Cipher Version.
     /// </summary>

wrappers/csharp/src/Enums.cs

@@ -674,23 +674,24 @@ public static bool VerifyPassword(byte[] password, byte[] hash, ILegacyHasher? l
         /// Use <see cref="HashPasswordWithParams"/> to supply custom <see cref="DerivationParameters"/>.
         /// </summary>
         /// <param name="password">The password to hash in bytes.</param>
+        /// <param name="version">The version of the password hashing algorithm to use. Defaults to <see cref="PasswordHashVersion.Latest"/>.</param>
         /// <returns>Returns the hashed password in bytes.</returns>
-        public static byte[] HashPassword(byte[] password)
+        public static byte[] HashPassword(byte[] password, PasswordHashVersion version = PasswordHashVersion.Latest)
         {
             if (password == null || password.Length == 0)
             {
                 throw new DevolutionsCryptoException(ManagedError.InvalidParameter);
             }
 
-            long hashLength = Native.HashPasswordLengthNative();
+            long hashLength = Native.HashPasswordLengthNative((ushort)version);
 
             if (hashLength < 0)
             {
                 Utils.HandleError(hashLength);
             }
 
             byte[] result = new byte[hashLength];
-            long res = Native.HashPasswordNative(password, (UIntPtr)password.Length, result, (UIntPtr)result.Length);
+            long res = Native.HashPasswordNative(password, (UIntPtr)password.Length, result, (UIntPtr)result.Length, (ushort)version);
 
             if (res < 0)
             {

wrappers/csharp/src/Managed.cs

@@ -119,10 +119,10 @@ public static partial class Native
         internal static extern long GetDefaultArgon2ParametersSizeNative();
 
         [DllImport(LibName, EntryPoint = "HashPasswordLength", CallingConvention = CallingConvention.Cdecl)]
-        internal static extern long HashPasswordLengthNative();
+        internal static extern long HashPasswordLengthNative(ushort version);
 
         [DllImport(LibName, EntryPoint = "HashPassword", CallingConvention = CallingConvention.Cdecl)]
-        internal static extern long HashPasswordNative(byte[] password, UIntPtr passwordLength, byte[] result, UIntPtr resultLength);
+        internal static extern long HashPasswordNative(byte[] password, UIntPtr passwordLength, byte[] result, UIntPtr resultLength, ushort version);
 
         [DllImport(LibName, EntryPoint = "HashPasswordWithParamsLength", CallingConvention = CallingConvention.Cdecl)]
         internal static extern long HashPasswordWithParamsLengthNative(byte[] derivationParams, UIntPtr derivationParamsLength);