feat(argon2): raise default memory cost to OWASP minimum (19 MiB) (#420)

Raise the default Argon2id memory cost from 4 MiB to 19 MiB to match the
OWASP minimum (m=19 MiB, t=2, p=1).

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: mmorrissette-devolutions

CHANGELOG.md

@@ -6,6 +6,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 
 ## [Unreleased] -
 
+### Breaking Changes
+
+- The default Argon2id parameters (`Argon2Parameters::default()`, `Argon2::new()`, `derive_key` / `encrypt_with_password` with `Latest`) now use 19 MiB of memory (19456 KiB) instead of 4 MiB, matching the OWASP Password Storage Cheat Sheet minimum (m=19 MiB, t=2, p=1). Existing data is unaffected: the parameters are serialized alongside every derivation and are read back from there. Callers that rebuild parameters from the defaults instead of persisting the serialized `Argon2Parameters` / `DerivationParameters` must pin `memory = 4096` to keep deriving the same keys.
+
 ## [0.10.2] - 2026-09-14
 
 - Fix a double free in the C# wrapper

python/CHANGELOG.md

@@ -6,6 +6,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 
 ## [Unreleased]
 
+### Breaking changes
+
+- The default Argon2id parameters now use 19 MiB of memory (19456 KiB) instead of 4 MiB, matching the OWASP minimum. Existing data is unaffected since the parameters are serialized with each derivation.
+
 ## [2026.6.16] - 2026-06-16
 
 ### Breaking changes

src/argon2parameters.rs

@@ -23,7 +23,7 @@ pub mod defaults {
 
     pub const LENGTH: u32 = 32;
     pub const LANES: u32 = 1;
-    pub const MEMORY: u32 = 4096;
+    pub const MEMORY: u32 = 19456;
     pub const ITERATIONS: u32 = 2;
     pub const VARIANT: Variant = Variant::Argon2id;
     pub const VERSION: Version = Version::Version13;
@@ -105,13 +105,13 @@ impl Default for Argon2Parameters {
         Argon2Parameters {
             associated_data: Vec::new(),
             secret_key: Vec::new(),
-            length: 32,
-            lanes: 1,
-            memory: 4096,
-            iterations: 2,
-            variant: Variant::Argon2id,
-            version: Version::Version13,
-            dc_version: 1,
+            length: defaults::LENGTH,
+            lanes: defaults::LANES,
+            memory: defaults::MEMORY,
+            iterations: defaults::ITERATIONS,
+            variant: defaults::VARIANT,
+            version: defaults::VERSION,
+            dc_version: defaults::DC_VERSION,
             salt,
         }
     }

wrappers/csharp/tests/unit-tests/TestManaged.cs

@@ -349,7 +349,7 @@ public void GetDefaultArgon2ParametersSizeNative_Default()
             Argon2Parameters defaultArgon2Parameters = Managed.GetDefaultArgon2Parameters();
 
             Assert.IsTrue(defaultArgon2Parameters != null);
-            Assert.IsTrue(defaultArgon2Parameters.Memory == 4096);
+            Assert.IsTrue(defaultArgon2Parameters.Memory == 19456);
         }
 
         [TestMethod]

wrappers/wasm/demo/src/app/derive-encrypt/derive-encrypt.component.html

@@ -79,8 +79,8 @@ <h1>Derive and Encrypt</h1>
           <details style="border:1px solid #ddd;border-radius:6px;padding:0.75rem 1rem;margin:0.5rem 0 0.75rem;">
             <summary style="font-size:0.85rem;color:#666;cursor:pointer;user-select:none;">Argon2 Parameters (optional)</summary>
             <div class="field">
-              <label>Memory (KiB) <span style="font-weight:normal;color:#888;">— default: 4096</span></label>
-              <input type="number" formControlName="argon2Memory" min="8" placeholder="e.g. 4096">
+              <label>Memory (KiB) <span style="font-weight:normal;color:#888;">— default: 19456</span></label>
+              <input type="number" formControlName="argon2Memory" min="8" placeholder="e.g. 19456">
             </div>
             <div class="field">
               <label>Iterations <span style="font-weight:normal;color:#888;">— default: 2</span></label>

wrappers/wasm/demo/src/app/key-derivation/key-derivation.component.html

@@ -44,8 +44,8 @@ <h1>Key Derivation</h1>
         <!-- Argon2 parameters -->
         @if (algorithm === 'argon2') {
           <div class="field">
-            <label>Memory (KiB) <span style="font-weight:normal;color:#888;">— default: 4096</span></label>
-            <input type="number" formControlName="argon2Memory" min="8" placeholder="e.g. 4096">
+            <label>Memory (KiB) <span style="font-weight:normal;color:#888;">— default: 19456</span></label>
+            <input type="number" formControlName="argon2Memory" min="8" placeholder="e.g. 19456">
           </div>
           <div class="field">
             <label>Iterations <span style="font-weight:normal;color:#888;">— default: 2</span></label>