1
$\begingroup$

Normally I use Argon2 to generate an encryption key, and then use AES to encrypt data with that key. Can I just set the hash size to be equal to the data size, set the associated data to a random value, and then just use Xor on the Argon2 output to encrypt/decrypt the data instead? Or are there some cryptographic properties that make it insecure to use it this way?

$\endgroup$
1

1 Answer 1

2
$\begingroup$

If you look at the pseudo-code of Argon2 you'll find that it creates the "tag" at the end of the function:

 return Hash(C, tagLength)

The tag itself is just a hash. For Argon2, the Hash call uses Blake2b to create a hash function with configurable output size as the call above implies. For larger output it uses the initial Blake2b hash as starting point and then iteratively creates the follow-up blocks by rehashing the material.

Obviously it would be problematic if all the blocks would be output as that would mean that anybody could reconstruct all the bits if they new the first block. Fortunately Argon2 outputs only 32 out of the 64 bytes produced for each block, leaving 256 bits to remain unknown. This also means that you'd require two calls to Blake2b instead of one, halving the maximum performance that you would expect. Clearly this wasn't designed for maximum speed. Note that the digestSize - the length of the output - is also included in the initial call to Blake2b, meaning that you'll have to know the key stream size in advance.

So is it secure? Well, there are distinguishers for reduced round Blake2 but those are not practical, and it is unlikely that a quantum computer will break the algorithm any time soon. Keeping 256 bits out of each block unknown seems fine as well.

So yes, in principle you could use it to encrypt using XOR. Argon2 also has a limit of $2^{32}$ bytes, so going over 4 GiB is not possible. using a fast authenticated (stream) cipher should definitely be preferable.

$\endgroup$
4
  • $\begingroup$ I'm having trouble finding information on Argon2b, is this one of the new competition algorithms? $\endgroup$
    – Alice
    May 2, 2023 at 13:11
  • $\begingroup$ No, that's a typo, it is blake2b and just argon2, adjusted, my apologies. $\endgroup$
    – Maarten Bodewes
    May 2, 2023 at 13:29
  • $\begingroup$ Oh ok. My C# version has an int for the length so it only supports 2 GB size hashes. I wasn't sure if there was some new version that had an unsigned int instead. $\endgroup$
    – Alice
    May 2, 2023 at 13:34
  • $\begingroup$ Well in the end it is a PBKDF, a 2 GiB key is relatively large :) I can get that they didn't think allowing the full size was that important. I'll add a note that the trick that is used for Blake2b for the Hash function will require double the amount of calls to Blake2b. $\endgroup$
    – Maarten Bodewes
    May 2, 2023 at 14:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.