4
$\begingroup$

I know that Argon2d accesses the memory array in a password dependent order and Argon2i accesses the memory array in a password independent order. What is the difference in computational complexity?

$\endgroup$
  • 1
    $\begingroup$ TL;DR: both scale the same when it comes to the parameters, but Argon2d has better time-memory-trade-off resistance whereas Argon2i has better side-channel resistance. $\endgroup$ – SEJPM Dec 14 '17 at 10:59
  • 1
    $\begingroup$ Related: Why use argon2i or argon2d if argon2id exists? $\endgroup$ – Frank Denis Dec 14 '17 at 15:41
6
$\begingroup$

As @sejpm already hinted in his comment: both scale the same when it comes to the parameters.

You might still want to read the RFC to get the complete picture, but the general differences can be quickly summarized:

Argon2i

Argon2i is invulnerable to side-channel timing attacks, but is weaker against time-memory trade-off (TMTO) attacks.

Argon2i uses data-independent memory access, which is preferred for things like password hashing and password-based key derivation.

Argon2d

Argon2d is vulnerable to side-channel timing attacks, but offers the best resistance to TMTO attacks.

Argon2d uses data-depending memory access, which makes it more suitable for things like cryptocurrencies and proof-of-work (POW) applications with no threats from side-channel timing attacks.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.