Argon2 or scrypt instead of PBKDF2 with AES

Question

Is using scrypt or argon2 a better key stretching technique with AES compared to PBKDF2 or bcrypt with regards to a quantum computer brute force attack. The brute force attack I'm referring to is trying to generate keys from lets say a million passwords and trying them on an encrypted text to get the password. In other words, can a quantum computer scale up a memory intensive hash generation with scrypt or argon2 compared to PBKDF2 or bcrypt?

Answer 1

Such quantom attacks are entirely theoretical, we are nowhere near having quantom computers brute force passwords. It is thus difficult to compare. Argon2 might be harder to implement on quantom computers but also the others are so far from being practical it seems pointless to try and compare how these would fair against a mythical adversary. In general quantom computers can break passwords in a square root of the effort and that is true for all the mentioned algorithms.

However there are far more practical attacks to consider, mainly using GPUs and dedicated hardware. That is where the advantages of argon2 over bcrypt or PBKDF2-SHA1 for instance come into play. Argon2 requires not only CPU but also RAM, while the others hardly use memory. This deminishes the attacker advantage of dedicated hardware or GPUs.

I stillb consider bcrypt a safe option, but assuming you have available RAM you will get a better slowdown factor against a sophisticated adversary by using argon2.