54
$\begingroup$

I wonder if it can be approximated how much of a security margin the new argon2 hash, winner of the password hashing competition, can give over bcrypt or PBKDF2, for an attacker using large GPU systems.

Practically speaking, if I have had a key-derivation-function running for one second on my server, how much of a security margin am I roughly gaining by running argon2 for one second (e.g. using 2GB of memory, otherwise default settings).

I am looking for more of a theoretical answer / guess based on the cryptographic differences between these schemes.

Improve this question
$\endgroup$

1 Answer 1

Reset to default
34
$\begingroup$

Coming up with a specific number is hard. Realistically, all three options take you well out of the realm of ever having more than the absolute worst passwords brute-forced by an attacker.

The primary gain of scrypt and Argon2 over bcrypt is a hit to parallelism due to the addition of memory requirements. GPUs with thousands of cores will need (but don't have) absurd amounts of memory, so most of those cores will need to remain idle. FPGAs and ASICs become much more expensive as they have to incorporate large amounts of memory, so you're really just forcing an attacker to trade a significantly larger number of dollars for equivalent parallelism.

The primary gains of Argon2 over scrypt (anyone correct me if I'm wrong):

  • improved resistance against Time Memory Trade-Off Attacks (TMTO),
  • better side-channel resistance (scrypt is vulnerable to cache-timing attacks due to secret-dependent memory access patterns), and
  • the ability to increase CPU and memory requirements independently of one another.
Improve this answer
$\endgroup$
9
  • $\begingroup$ "an attacker can simply throw double the cores at the problem to halve memory" - I'm pretty sure this doesn't hold for scrypt.Advantages of Argon2: Easier configuration and usage, better TMTO trade-offs, better side-channel resistance, better adaptibility to various platforms, finer configuration (increase time (linearly) easily without memory penalty and vice versa (although time will grow linearly in this case as well)) $\endgroup$
    – SEJPM
    Commented Nov 23, 2015 at 22:09
  • 1
    $\begingroup$ @otus: You're right; it's been awhile since I've read the scrypt paper. I'll update the answer. $\endgroup$
    – Stephen Touset
    Commented Nov 23, 2015 at 23:22
  • $\begingroup$ @SEJPM: even cperciva points out the TMTO, although it apparently has a constant tradeoff factor (which I believe argon2 avoids; I'll have to confirm). $\endgroup$
    – Stephen Touset
    Commented Nov 23, 2015 at 23:22
  • 1
    $\begingroup$ @Stephen: thanks, but do you know the TMTO factor (approximately) of argon2? That would be the really interesting fact to know in order to estimate argon2 advantage over say bcrypt. $\endgroup$
    – azren
    Commented Nov 24, 2015 at 8:07
  • 11
    $\begingroup$ For everyone that's wondering like i was, TMTO means "Time Memory Trade-Off Attacks". $\endgroup$
    – ttt
    Commented Apr 5, 2017 at 7:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.