I am trying to figure out the best parameters for Argon2 for password hashing.

I have read the RFC and the recommendations they put in it. So I follow up the recomendation on the paper depending on my target machine.

The thing is that one single call fits perfect into the desired time. However they never mention about several calls at the same time.

For example. I have a server with 8 CPU cores and 32GB RAM. Then I configure an Argon2id with: 16 lanes, 1 iteration, and 128MiB memory.

I call it once. Perfect! I got an execution time of ˜50ms. Now I simulate several calls at the same time. Execution time increases a lot. For 20 parallel calls, execution time goes up to ˜500ms.

I can tune the algorithm to fit with the average traffic on the server to fit the desired time, but everytime I will have a peak, performances will be deteriorated. And this also means to lower the values which means cheaper to attack.

Which is the best way to proceed?

Thank you

  • $\begingroup$ Remember, the iteration is to reduce the attack time and memory is reduce the parallelization. Yo need more iterations as 1000000. $\endgroup$ – kelalaka Jan 29 at 18:05
  • 5
    $\begingroup$ @kelalaka I think 1,000,000 iterations for Argon2 is very excessive. For 128 MiB, that would require performing more than a hundred terabytes of memory access. Also, for Argon2, iterations is primarily not to increase processing time but to reduce the TMTO ratio the attacker can pull off. More iterations means less flexibility for the attacker, no matter how long each iteration takes. $\endgroup$ – forest Jan 30 at 6:05
  • 2
    $\begingroup$ @kelalaka Argon2 doesn't work like PBKDF2. It has two cost parameters. The "time" parameter is the number of passes made over the memory buffer. (This is why increasing the memory parameter and leaving the pass count alone increases run time.) There is no iteration-count parameter of the sort that PBKDF2 has. If you use enough memory then the number of passes can be fairly small. As low as 1 for Argon2d and 3 (or maybe more) for Argon2i. Using gigabytes of memory with a single digit number of passes is preferable to using low memory with many many passes. $\endgroup$ – Future Security Aug 14 at 16:33
  • $\begingroup$ What do you mean by 500ms execution time? That's not the total wall clock time between the first request and the last hash to finish. I would expect that to be at least 20 times the single hash time if you had 20 parallel hashes. (With that many lanes it should be.) How do you measure run time? $\endgroup$ – Future Security Aug 15 at 0:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.