The balloon hashing algorithm has been compared to the argon2 algorithm, and with its memory accesses being password independent it is most similar to argon2i. Sources such as the RFC for argon2 and OWASP recommends the use of argon2id for password hashing above both argon2i and argon2d, and I've seen many others make the same recommendation.

Therefore I was thinking of how to make the balloon hash act more like argon2id instead of argon2i. I couldn't find any resources where this was done, so since it seemed like a simple modification I came up with a suggestion of my own. In section 3.1 of the balloon paper they describe the algorithm and provide a pseudocode outline. In step 2b:

// Step 2b. Hash in pseudorandomly chosen blocks.
for i from 0 to delta-1:
    block_t idx_block = ints_to_block(t, m, i)
    int other = to_int(hash(cnt++, salt, idx_block)) mod s_cost
    buf[m] = hash(cnt++, buf[m], buf[other])

in order to create the argon2d-like algorithm, would it be enough to change the index of the dependency blocks to be password dependent? I.e. changing that line to the following:

int other = to_int(hash(cnt++, salt, password, idx_block)) mod s_cost

So the first half of the rounds are the regular "i-variant" and the second half is this proposed "d-variant", making the whole more similar to argon2id. I can't see any obvious issues with this idea. Maybe there are other places where this has already been investigated or discussed? It would be a simple extension of balloon hash, and it felt logical since it's been compared to argon2.

  • $\begingroup$ d- variant is made for the coins, i- variant is made for password hashing, so what is your aim? $\endgroup$
    – kelalaka
    Commented May 26 at 12:26
  • $\begingroup$ I didn't know they already used a different variation for cryptocurrency, I've only seen the i-variant before. I tried to look into it knowing to search for crypto implementations but I've had no luck so far. Thanks for the suggestion of where to look. $\endgroup$
    – n-l-i
    Commented May 26 at 18:24
  • $\begingroup$ datatracker.ietf.org/doc/html/rfc9106#name-parameter-choice $\endgroup$
    – kelalaka
    Commented May 27 at 7:22
  • 1
    $\begingroup$ I'm working on an Internet-Draft for Balloon with breaking changes from the paper due to issues with the paper like the algorithm not being properly specified. It's still a work in progress, but I would urge you to use that rather than the paper once it's done. However, the performance of Balloon appears to be quite bad compared to Argon2, so there's little incentive for people to use it. What you're talking about can be done, and I actually started designing an algorithm like that based on Balloon but haven't published it. $\endgroup$ Commented May 27 at 20:03
  • 1
    $\begingroup$ After recapping my informal, not properly researched design, I'm using the previousBlock to get random indices, which is obviously dependent on the password and salt. However, my algorithm is nothing like Balloon in that it's not using a hash function for the mixing but a duplex-style AEAD, which can be more performant. $\endgroup$ Commented May 27 at 20:11


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.