From 402addca27dd7ef4c1ab1dc72ab21b77f6a7b359 Mon Sep 17 00:00:00 2001
From: michael <operations@dangerousthings.com>
Date: Mon, 27 Apr 2026 09:23:20 -0700
Subject: [PATCH] chore(daemon): add argon2 0.5 for recovery code hashing

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 Cargo.lock        | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 Cargo.toml        |  1 +
 daemon/Cargo.toml |  1 +
 3 files changed, 48 insertions(+)

diff --git a/Cargo.lock b/Cargo.lock
index 028e853..109a9b1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -90,6 +90,18 @@ version = "1.0.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
 
+[[package]]
+name = "argon2"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
+dependencies = [
+ "base64ct",
+ "blake2",
+ "cpufeatures",
+ "password-hash",
+]
+
 [[package]]
 name = "asn1-rs"
 version = "0.7.1"
@@ -283,6 +295,7 @@ name = "authforge-daemon"
 version = "0.1.0"
 dependencies = [
  "anyhow",
+ "argon2",
  "authforge-common",
  "ctap-hid-fido2",
  "futures-util",
@@ -325,6 +338,12 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
 [[package]]
 name = "bitflags"
 version = "1.3.2"
@@ -337,6 +356,15 @@ version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
 
+[[package]]
+name = "blake2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+dependencies = [
+ "digest",
+]
+
 [[package]]
 name = "block-buffer"
 version = "0.10.4"
@@ -642,6 +670,7 @@ checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer",
  "crypto-common",
+ "subtle",
 ]
 
 [[package]]
@@ -1694,6 +1723,17 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "password-hash"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
+dependencies = [
+ "base64ct",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
 [[package]]
 name = "pin-project-lite"
 version = "0.2.17"
@@ -2126,6 +2166,12 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
 [[package]]
 name = "syn"
 version = "2.0.117"
diff --git a/Cargo.toml b/Cargo.toml
index 864c215..ba1b197 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -33,3 +33,4 @@ notify = "6"
 rusqlite = { version = "0.31", features = ["bundled"] }
 futures-util = "0.3"
 hex = "0.4"
+argon2 = "0.5"
diff --git a/daemon/Cargo.toml b/daemon/Cargo.toml
index 3da75b7..5a85551 100644
--- a/daemon/Cargo.toml
+++ b/daemon/Cargo.toml
@@ -26,6 +26,7 @@ rusqlite = { workspace = true }
 toml = { workspace = true }
 ctap-hid-fido2 = { workspace = true }
 hex = { workspace = true }
+argon2 = { workspace = true }
 
 [dev-dependencies]
 tempfile = { workspace = true }