Is Argon2id safe from the discovered Argon2i issues?

Question

So far, as I understand it, two ways to reduce the complexity of Argon2i have been found, one of which was fixed in Argon2 1.3, and one of which is still unfixed but is not a practical problem given enough Argon2i passes.

What I have not seen properly explained anywhere, is whether these weaknesses effect Argon2id, or if the combination is still good - basically, is the weakness in Argon2i enough to undermine the benefits of using it as the first half-pass of Argon2id, or do the passes of Argon2d after basically "cover" it somehow?

My naive intuition is at worst you lose the side-channel resistance, but does this compromise the side-channel resistance?

---

The weakness I am thinking of that is still applicable to Argon2 1.3 is the one described in "Towards Practical Attacks on Argon2i and Balloon Hashing"

---

Related to, but not a duplicate of this one, because while the comments and answer there suggest that

1. argon2id 1.3 takes those known attacks into account, and
2. argon2id is different enough from argon2i that it is probably safe to assume attacks on the latter do not apply to the former,

it is not clear to me that this actually fully covers my question, and certainly when I was looking for duplicate questions, it was not obvious to me that a question about "which one to choose?" would even touch upon my question - certainly the question as titled points in a completely different direction.

Answer 1

1. Covers Argon2id the known attacks? Although there is no research into this, I would say that Argon2id is probably not vulnerable to the attack shown by Alwen and Blocki. Maybe an attack on the first part (the Argon2i part) could be practically applicable, but the advantage for the attack quality would be ruined by the second part (the Argon2d part), because the second part is the more memory-hard one.

2. Is Argon2id still side-channel resistant? Reasonably or at least halfway. If you successfully perform a cache-timing attack on the second part (the Argon2d part), you will receive certain patterns, but they only refer to equal outputs of the first part (the Argon2i part), not to passwords.

Both attacks are complex and it is not entirely clear whether they are feasible today.

As far as I know, cache-timing attacks have not yet been executed against password hashing methods in the wild (for example against Scrypt). However, it has been shown that this is basically possible and it is quite feasible that such attacks will be carried out in the future. Schemes based on the "Bit Reversal Graph" like Argon2i and Catena-Dragonfly seemed to be the solution - they were just less memory-hard.

Although there were voices that suggested that, the authors of Argon2 did not originally include the possibility of combining Argon2i and Argon2d (a hybrid structure), presumably to avoid making the usage more complicated. Lyra2 and other schemes of the password hashing competition relied on the hybrid structure from the beginning, mainly as a compromise between resistance against cach-timing attacks and higher memory-hardness.

It was only after the end of the password hashing competition that it became apparent that methods that are resistant to cache timing attacks are more vulnerable in other ways.

The attack of Alwen and Blocki is based on several conditions such as no parallelism (p=0) and assumptions about (probably realistic) hardware available in the future. But still a weakness is shown, which could possibly be extended even further. I don't know of any official statement about this, but I suppose that in view of the attacks on Argon2i, the authors of Argon2 are now tending to prefer the hybrid structure.

Password hashing is an area that is much less explored than, for example, block cipher. It is therefore possible that new cryptoanalyses will be published and further changes may be necessary.