It's a fact that scrypt and argon2 are the two dominant memory hard KDFs. But which one of them is more recommendable for password hashing? scrypt is older and as far as I know resistant to almost every kind of hardware based attack. But vulnerable to side channel attacks. How strong is argon2 (i/d) compared in the regards of memory hardness and side channel resistance?
$\begingroup$
$\endgroup$
asked Aug 9, 2017 at 18:23
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
5
As far as I read, scrypt can be used for some time/memory tradeoffs where you save memory but take more computations, which may truly be an annoying thing.
Argon2d uses data dependent on the input (i.e. the password), which makes it a lot stronger against these tradeoff attacks but opens side-channels (which IIRC is only a problem if you have an attacker directly on your computer, meaning that it isn't too bad on web servers you don't share with others).
Argon2i instead has independent data, which thwarts the side channels but has it a little more open against the tradeoff, so not the best idea but still not a bad thing.
And then there's Argon2id, which uses them in a hybrid way to thwart both tradeoffs and side channels.
The IETF draft states:
If you do not know the difference between them or you consider side-channel attacks as viable threat, choose Argon2id.
So the best way to go would be Argon2id.
By the way, a small update:
PHP has Argon2id set for going into 7.3 and unless something goes seriously wrong in the next few days until Feature Freeze, it will be a part of PHP 7.3's password_hash(), making it available to people without access to extensions.
-
3$\begingroup$ Actually, Argon2d can be bad on web-servers because they are commonly shared instances (VMs, containers, whatever) with other people on the same physical machine. $\endgroup$– SEJPMSep 14, 2017 at 10:22
-
$\begingroup$ although is the access on a different VM on the same machine enough to get your side channel? especially also since it's not just the attacker and the victim, although that might be an intresting question for security. but thanks anyway for the info btw edited my question to include "non shared" for the servers $\endgroup$– My1Sep 14, 2017 at 12:01
-
1$\begingroup$ scrypt and Argon2d have exactly the same issues with respect to side-channel leakage. $\endgroup$ Sep 17, 2017 at 11:35
-
2$\begingroup$ that's a really intresting info so scrypt has sidechannels AND tradeoffs? now THAT hurts, so argon2id all the way, I guess $\endgroup$– My1Sep 18, 2017 at 9:02
-
$\begingroup$ @My1 yes, it is. See the Meltdown and Spectre vulnerabilities, which allow reading private memory of other processes running on the same hardware via cache-based side channels. $\endgroup$ Mar 7, 2018 at 11:20