I know that Argon2d accesses the memory array in a password dependent order and Argon2i accesses the memory array in a password independent order. What is the difference in computational complexity?
$\begingroup$
$\endgroup$
2
-
2$\begingroup$ TL;DR: both scale the same when it comes to the parameters, but Argon2d has better time-memory-trade-off resistance whereas Argon2i has better side-channel resistance. $\endgroup$– SEJPMCommented Dec 14, 2017 at 10:59
-
1$\begingroup$ Related: Why use argon2i or argon2d if argon2id exists? $\endgroup$– Frank DenisCommented Dec 14, 2017 at 15:41
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
As @sejpm already hinted in his comment: both scale the same when it comes to the parameters.
You might still want to read the RFC to get the complete picture, but the general differences can be quickly summarized:
Argon2i
Argon2i is invulnerable to side-channel timing attacks, but is weaker against time-memory trade-off (TMTO) attacks.
Argon2i uses data-independent memory access, which is preferred for things like password hashing and password-based key derivation.
Argon2d
Argon2d is vulnerable to side-channel timing attacks, but offers the best resistance to TMTO attacks.
Argon2d uses data-depending memory access, which makes it more suitable for things like cryptocurrencies and proof-of-work (POW) applications with no threats from side-channel timing attacks.
