I am developing a post quantum safe GPG like program, is argon2 quantum safe cryptographically for GPG like application.

  • $\begingroup$ Related: crypto.stackexchange.com/questions/95257/… $\endgroup$ Jul 19, 2022 at 7:33
  • 2
    $\begingroup$ Does that answer have enough information for you? Because Argon2 is not fundamentally different from other password hashes in this regard. $\endgroup$
    – Maarten Bodewes
    Jul 19, 2022 at 7:45
  • 1
    $\begingroup$ Thank you guys , yes the information shared did answer my question . $\endgroup$ Jul 20, 2022 at 3:46

1 Answer 1


Simply put, it should be because it's based on BLAKE2b, it's memory hard, and symmetric cryptography is relatively unaffected by quantum computing since attacks can't be carried out efficiently compared to those for asymmetric cryptography (e.g. Grover's algorithm vs Shor's algorithm). The RFC states the following:

The collision and preimage resistance levels of Argon2 are equivalent to those of the underlying BLAKE2b hash function. To produce a collision, 2^(256) inputs are needed. To find a preimage, 2^(512) inputs must be tried.

The KDF security is determined by the key length and the size of the internal state of hash function H'. To distinguish the output of the keyed Argon2 from random, a minimum of (2^(128),2^length(K)) calls to BLAKE2b are needed.

That's enough not to worry.

  • 1
    $\begingroup$ Grover's Algorithm doesn't preclude existence of another more efficient algorithm in a particular case so the comment about it doesn't make sense. $\endgroup$ Jul 19, 2022 at 16:40
  • $\begingroup$ @ReinstateMonica How's the wording now? $\endgroup$ Jul 19, 2022 at 17:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.