Why did Argon2 win the PHC?

Question

I've been reading up on Argon2 (and, to a lesser extent, other recent password hashers). I'm trying to understand why it won the competition versus the other finalists, like Catena, Lyra2, Makwa or Yescrypt.

Unfortunately, I don't see much technical discussion on the competition's website. It does link to the mailing list archives, but I can't find the actual mailing list there (although I haven't tried the NNTP option, since I don't have an NNTP client) due to some broken links. I'm unclear if that's a temporary problem, or a permanent one.

I have two closely-related questions, either of which I would be grateful for insight on:

• I've been proceeding under the belief that PHC is a well-regarded and competently run competition that is considered to have advanced the state of the art in password hashing. Was there any notable controversy surrounding it, e.g. serious concerns with the panel, submission or winner selection processes?
• What were the key factors that led to Argon2 being declared the winner by the PHC panel, compared to the other finalists?

Answer 1

I have been part of several cryptographic competitions (AES, eSTREAM, SHA-3, PHC). In every single one of them, some people worded bitter reproaches and wailed and whined about the unfairness of the selection process. It's just that people are like that, and being very good at cryptography does not prevent smart cryptographers from being basically people.

The mailing-list was hosted on Gmane, which was a free resource maintained by somebody on his spare time. In July 2016 he decided he had had enough of it (he was fed up with recurrent DoS attacks). The PHC mailing-list archives, though, were recovered and put back online by Alexander Peslyak (aka "Solar Designer", who was behind the yescrypt PHC candidate). You can see for instance the winner announcement there.

Answer 2

I agree with Thomas Pornins answer, but there was one remarkable criticism on the panel. Round two of the competition actually allowed only minor tweaks. Argon switched to Argon2, which was more a new scheme and not a tweak. I welcome the unbureaucratic decision of the panel to accept Argon2, but formally this is objectionable.

The answer for the second question is, of course, a bit speculative. There were nine schemes left in round two, so perhaps the exclusion of the other schemes would answer your question. Makwa (and also Parallel) is not suitable for all purposes of password hashing. Pomelo is not based on approved algorithms like Blake2 or SHA3 and there was too little research on it. Battcrypt and Pufferfish are less memory hard than Scrypt. After a discussion about cache timing resistance versus memory hardness, the panel apparently preferred a cache-timing-resistant scheme. Yescrypt is not, Lyra2 is only a hybrid scheme (like Argon2id and Pomelo). There were only two completely cache-timing-resistant schemes left in round two: Catena and Argon2i. Argon2i has better performance, mainly because of the use of parallelism. That means that Argon2i is more memory hard for a given time than the Catena variants. The decision can be criticized, but I think it is comprehensible.

Answer 3

Some resources:

1. The Argon2: paper and GitHub repo
2. Catena: paper, a good thesis and GitHub repo
3. Makwa: paper
4. Yescrypt: paper
5. Lyra2: paper and GitHub repo
6. A GitHub repository with round 1 submissions
7. A GitHub repository with round 2 performance analysis (not the official one though, iirc).
8. Comparison of the candidates: Forler et al, Biryukov and Khovratovich, Chang et al, surely there are other papers.

Another answer has a very important thought: password hashing competition does not really provide you with definitive answers and recipes about how to hash your passwords. Instead, it triggered a lot of research which addresses memory-hard hash functions. The PHC finalists have some very different cores: Makwa does something with Blum integers, Catena is mostly about Bit Reversal Graphs, Lyra2 is the new Sponge hotness and Argon2 is probably the most polished (for example, a local search giant has recently rolled an open source optimized Argon2 which made it into the news).

So, at least to me it feels like nobody will tell you what to choose. Instead, you will have to put in some hours to understand the details and make your educated decisions. Maybe you need some of the unique features, like server-relief, escrow or whatever else (not all of the schemes provide extra goodies). If it is any consolation, Lyra2 is easy enough for an average bachelor student to understand in ~3 months and be able to reimplement in a different language. See my GitHub, my comparison to reference (I am worse) and an android app.