# How to make my hash more robust to the brute force?

I'm using PBKDF2 SHA 256 with 100 000 iterations to generate a secret.

I want to increase the cost of brute forcing the passphrase I use to generate the secret.

I'm thinking of using scrypt after the pbkdf2 computation.

scrypt(pbkdf2(passphrase, salt))


Is there a better way?

• Have you considered using Argon2? crypto.stackexchange.com/q/30785/54184 – forest Dec 29 '18 at 10:46
• – forest Dec 29 '18 at 10:49
• Should we migrate? Also look at some figures for some of the upmost systems. – kelalaka Dec 29 '18 at 10:50
• I think this question can stay here as it's essentially about the theory of password hashing. – SEJPM Dec 29 '18 at 13:25
• Same as this answer, use only the strongest of the two. (Which is scrypt) Argon2 is even better. – Future Security Dec 29 '18 at 19:18

## 1 Answer

I would recommend you use Argon2, which is both a slow KDF like PBKDF2, as well as a memory-hard function designed to improve resistance to GPUs and FPGAs like scrypt. You can select both the number of iterations and amount of memory used in Argon2, and they can be changed independently (unlike scrypt, where the memory and time difficulties cannot be modified separately, and high time implies high memory-usage). This can be done on existing password hashes to maintain backward compatibility, but I would suggest you convert the old scheme (PBKDF2 with scrypt) into one using just Argon2 as soon as a user next logs in and supplies their password.