5
$\begingroup$

I am planning to use Argon2 in my Android app to encrypt some sensitive info that is only stored on the user's phone (in an SQLite DB) and not exported anywhere else. From documentation I see that Argon2d is more resistant to GPU based brute-force attacks compared to side-channel attack in 2i.

Would this mean that in my scenario, it'd be better to use the 2d implementation? Since, in "usual" scenarios it is apparently recommended to use 2i.

Finally, is Argon2 studied sufficiently enough, or should I choose the Android natively supported PBKDF2 with HMACSHA1. I can reasonably use 20,000 iterations in the latter.

Basically, I want to delay malpractice/protect user's data from being decrypted through brute-force methods. I do understand that it also depends on the user's password input.

$\endgroup$
  • $\begingroup$ Argon2 has seen a lot of scrutiny and is a good choice thus. As you have a client-side-only application where you probably have bigger problems if the attacker can pull cache-timing or related side channel attacks off, you are fine with Argon2d (KeePass also uses Argon2d). Side-channel resistence (like with Argon2i) is "critical" when you have a scenario like a public cloud service provider with shared hosts. $\endgroup$ – SEJPM Jun 8 '17 at 19:42
  • $\begingroup$ I agree with SEJPM; use Argon2d. You see Argon2i recommended a lot because Argon2 is also used for server side password-based authentication, but this is quite a different use case from local key derivation. Plus, on mobile devices where people pick bad passwords and you can't jack up the difficulty parameters as much, you'll want Argon2d's better tradeoff resistance. $\endgroup$ – user40185 Jul 9 '17 at 23:32
  • 4
    $\begingroup$ Use Argon2id, which combines Argon2i and Argon2d, and is what the Argon2 authors now recommend. $\endgroup$ – Frank Denis Dec 14 '17 at 15:36
8
$\begingroup$

TL;DR: You want to use Argon2d here.

Even though Argon2 was standardized only somewhat recently, it is the result of the Password-Hashing Competition (2013-2015) and was a late re-design of Argon which also picked up ideas from a few other finalists. Since then there have been attacks on it, which caused the scheme to be tweaked to counter them better, this is why we have Argon2 v1.3 as the most current version, you may want to note that most of these attacks mostly weakened Argon2i and not Argon2d.

Now during the competition results came up that your defense against time-memory trade-off attacks will suffer if you make sure that your scheme is immune to the various kinds of side-channel attacks that people have come up with (which also includes more "crazy" stuff like leaked intermediate state). Because of this, it was decided that there should be two versions: Argon2i and Argon2d. One offering the best possible protection while trying its best to be immune against side-channel attacks (by using data- and password-independent memory access patterns) and the other dropping these requirements and all-out optimizing against such attacks (by using data- and possibly password-dependent memory access patterns).

Enough with the history now. Argon2d offers better protection than Argon2i at the expense of being more vulnerable to side-channel attacks. Now you have to ask yourself: Do these apply? No, not really. You said that you are on Android, which is not exactly known for high platform security, so if you have an attacker in such a privileged position to execute something like cache-timing attacks or similar attacks that try to exploit memory access patterns, your user has already much bigger problems anyways.
It's a similar logic as with AES: There are cache-based side-channel attacks, but these have never been observed in the wild, probably because other options are much easier, more relieable and equally as effective.
So the conclusion is: You want to use Argon2d.

So for whom is Argon2i? People who need to run applications on shared hardware or where timing attacks are a real thread. For example if you run a webserver in a public cloud on shared hardware. Then you have to be worried about who else is on the same CPU. And with webservers it's also easier to measure the timing of reactions and trying to deduce information from that.

The final hint that Argon2d is the way to go here, is the fact that KeePass (one of the open-source password managers) also has decided for Argon2d.

$\endgroup$
  • 1
    $\begingroup$ Wouldn’t Argon2id, currently an RFC draft and the Argon2 authors current recommendation be a better choice for interoperability? $\endgroup$ – rmalayter Mar 7 '18 at 13:23
  • $\begingroup$ @rmalayter for interoperability or if you are intending to set standards, yes. Just for your own app, Argon2d should offer strictly stronger security. $\endgroup$ – SEJPM Mar 7 '18 at 13:24
  • 1
    $\begingroup$ after 20 years in IT, I can assure you there is never “just for your own app”. There is always ultimately a successor system, an unforeseen integrated system, etc. $\endgroup$ – rmalayter Mar 8 '18 at 2:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.