Why do two Argon hashes with the same password differ?

Question

Can someone explain to me what the ArgonHashString function in libsodium returns (i'm using the .net port).

For example i called it twice with the same string:

var foo1 = PasswordHash.ArgonHashString("f");
var foo2 = PasswordHash.ArgonHashString("f");

and i got entirely different answers:

"$argon2i$v=19$m=32768,t=4,p=1$rKEPCGqfhm7zQt8c2QBhRA$7oZHFjWhHdVg/31SottxDyVM5KA9+4IBc5qD5m9DNFI\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
"$argon2i$v=19$m=32768,t=4,p=1$o8MmGW+GoaVcQvBfmPDE8A$3mHVQbZz3JuLI++MIBC4JOI+/G2oVtq75Jbqml8lbEM\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"

Answer 1

This function returns a string that the verification function will consider valid when given the same password.

You shouldn't have to care about what the string actually contains. If only because the default algorithm and parameters can change. But the guarantee above will always be true.

But indeed, the string will be different if given the same password twice. It includes some randomness, so that by observing the hashed passwords of a user database, you can't tell that user1 and user2 share the same password.

Answer 2

ArgonHashString calls the libsodium function crypto_pwhash_str which automatically generates a salt value that is part of the result.