6
$\begingroup$

(I realise this is yet another Argon2 "how do I configure" question, but the existing questions I've found don't really help. If I've missed one, happy to have this closed).

Deploying Argon2 (with the Argon2id variant) into a server environment to hash passwords and process site logins - the question we're grappling with is "how much memory to allocate". Now, I'm aware it's "as much as practically possible" but I haven't found any guidance on a lower limit (e.g., something that says something like "below 16MB it's not worth it").

This question suggests 32MB is good enough for most applications, and this one suggests '0.75 * (memory / users)' as a guideline, but not sure if this is reasonable?

Obviously as iterations can be tuned upwards, we can maintain hardness in that dimension, but at what lower limit of memory would be considered "bad" or at least "not good" for Argon2? If this is purely to help avoid cache hits in a GPU then this would suggest allocations as low as 16MB may be okay, but am I missing something? If it's a case of "16MB okay, 32MB recommended, above 48MB there's nothing gained anything at the current state-of-the-art" that's also fine. I've seen people talk about 1GB allocations - this almost seems overkill?

| improve this question | |
$\endgroup$
  • $\begingroup$ This question may be hard to answer without knowing how much memory you have available on the server(s) that are computing the hashes. If you are running a single server with 4GB of RAM from out of your home you'll probably need a different answer than if you have a pool of 10 machines each with 64GB of RAM dedicated to password hashing. Also, the expected number of users you have may play a part as well. $\endgroup$ – Ella Rose Sep 4 '18 at 15:06
  • 1
    $\begingroup$ The standard recommendation is: Pick the memory usage as high as you can tolerate. $\endgroup$ – SEJPM♦ Sep 4 '18 at 17:58
  • 1
    $\begingroup$ Also the smallest value the Argon2 paper (section 8) mentions is 256MB with the standard recommendations being 1GB-6GB "aka" as much as you can afford. $\endgroup$ – SEJPM♦ Sep 4 '18 at 18:01
  • 1
    $\begingroup$ @SEJPM - I had seen this, but sec 8 though only talks about Argon2d and Argon2i - it doesn't reflect how the hybrid Argon2id affects this. Although yes, 250MB is the lowest value given in all the examples. Does this mean the suggestion of "32MB being reasonable" that I linked from another question should be treated with care? $\endgroup$ – Chris J Sep 4 '18 at 18:42
  • 1
    $\begingroup$ @Ella - I was hoping the advice would be rather generic, rather than needing to provide server config. Other than "it's not as strong", are there any practical attacks that are opened if 32MB is selected over 256MB (but with iterations increased so that computation time is roughly equivalent). $\endgroup$ – Chris J Sep 4 '18 at 18:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.