I am trying to figure out the best parameters for Argon2 for password hashing.
I have read the RFC and the recommendations they put into it. So I follow up on the recommendation on the paper depending on my target machine.
The thing is that one single call fits perfectly into the desired time. However, they never mention several calls at the same time.
For example. I have a server with 8 CPU cores and 32GB RAM. Then I configure an Argon2id with: 16 lanes, 1 iteration, and 128MiB memory.
I call it once. Perfect! I got an execution time of ˜50ms. Now I simulate several calls at the same time. Execution time increases a lot. For 20 parallel calls, execution time goes up to ˜500ms.
I can tune the algorithm to fit with the average traffic on the server to fit the desired time, but every time I will have a peak, performances will be deteriorated. And this also means lowering the values which means cheaper to attack.
Which is the best way to proceed?