I wrote a small application that uses Argon2i for deriving symmetric keys for encryption of local files and secret Curve25519 keys. Argon2i v1.3 is susceptible to TMTO attacks if the number of passes is below 10, according to the most recent paper I could find: https://eprint.iacr.org/2016/759.pdf
Ideally, of course, I would increase both. However, I am trying to find parameters that maximize security on a variety of machines, some of which are limited by CPU much more so than by RAM, such as old laptops. Let's say I am aiming for a computation time of around 10 seconds. I can use much more RAM if the number of passes is 3, which is the minimum recommended for Argon2i. However, this appears to allow a TMTO attack that reduces that RAM usage according to the paper above. If I increase the number of passes to > 10, I must use much less RAM to achieve the same computation time, however, the TMTO attack above does not apply.
On fast CPUs, increasing the number of passes is not a big problem because I can still use a lot of RAM. On slow CPUs, it can be much more significant. As a practical example, I tried this on a T23 ThinkPad. The results are below.
Tcost=3 Mcost=128 MiB Parallelism=1 Computation time: 10 seconds
Tcost=11 Mcost=40 MiB Parallelism=1 Computation time: 10 seconds
Given the most recent TMTO attacks in the Alwen-Blocki paper above, does an attacker with a GPU gain more of an advantage attacking the first example or the second? What about an ASIC?
For reference, here's Argon2d with only 1 pass and a target of 10 seconds
Tcost=1 Mcost=448 MiB Parallelism=1 Computation time: 10 seconds
(I am strongly considering going to Argon2d)