I am trying to figure out the best parameters for Argon2 for password hashing.
I have read the RFC and the recommendations they put in it. So I follow up the recomendation on the paper depending on my target machine.
The thing is that one single call fits perfect into the desired time. However they never mention about several calls at the same time.
For example. I have a server with 8 CPU cores and 32GB RAM. Then I configure an Argon2id with: 16 lanes, 1 iteration, and 128MiB memory.
I call it once. Perfect! I got an execution time of ˜50ms. Now I simulate several calls at the same time. Execution time increases a lot. For 20 parallel calls, execution time goes up to ˜500ms.
I can tune the algorithm to fit with the average traffic on the server to fit the desired time, but everytime I will have a peak, performances will be deteriorated. And this also means to lower the values which means cheaper to attack.
Which is the best way to proceed?