8
$\begingroup$

I've read the manual, and multiple articles / StackExchange posts about this topic, but still can't decide which implementation of Argon2 is best for my use case.

I want to securely encrypt passwords in a database in an unshared environment. After first pass of the docs (pun-intended) it sounded like Argon2i is recommended in this case, but I feel like it's more likely for someone to gain access to the database directly and try to execute a GPU/ASIC/FPGA based attack to decrypt the data than someone gaining access to the network and attempting a side-channel attack.

I would like to prevent side-channel attacks if possible too, so that sounds like Argon2id is the way to go, but my understanding is the i-portion of the implementation only does one pass. Does the one pass really offer much protection against side-channel attacks (I read 3+ or even 10+ passes are needed to really secure Argon2i) and is there a way to increase the number of passes for the i-portion before the d-portion kicks in?

If Argon2id is the implementation for my use-case, but I can't increase the number of passes for the i-portion, would it make sense to effectively create my own "Argon2id" by implementing the Argon2i algorithm first, and then running the output through the Argon2d algorithm after?

$\endgroup$
  • $\begingroup$ Related: crypto.stackexchange.com/q/48935/54184 $\endgroup$ – forest Aug 7 at 5:02
  • $\begingroup$ Running Argon2 twice, giving each $\frac{t}{2}$ time, is basically less secure than running Argon2 once for $t$ time. (Same for any other split, not just 50-50.) The recommendation to first set the memory cost as high as possible and then set the number of passes as high as tolerable for that amount of memory is good advice. $\endgroup$ – Future Security Aug 8 at 19:52
  • 1
    $\begingroup$ Argon2id is its own algorithm. Caveats concerning Argon2i do not automatically apply to Argon2id. The newest documentation (Argon2 v 1.3) came after the TMTO discovered for a previous version of Argon2i. The newest designs and recommended method to choose parameters already takes the potential problem into account. $\endgroup$ – Future Security Aug 8 at 20:08
12
$\begingroup$

If you are unsure, then always choose Argon2id. Only choose Argon2d if you need maximum security at the expense of side-channel risk, and only choose Argon2i if side-channel attacks are the primary threat.

The number of passes just increases resistance to time-memory tradeoff attacks (TMTO). What you are probably remembering is that Argon2i is more vulnerable to TMTO attacks, and thus needs more passes to obtain the equivalent level of security. Argon2id uses the Argon2i pass to resist side-channel attacks, and the subsequent Argon2d passes to make up for TMTO resistance that the first pass lacks.

If an attacker performs a perfect side-channel attack and breaks the Argon2d portion, then they will still need to perform a very extensive TMTO attack to break the Argon2i passes. Compare this with pure Argon2d, where a successful side-channel attack completely negates its memory hardness. In other words, a side-channel attack against Argon2id reduces its security to one-pass Argon2i.

Note that some of the more severe TMTO attacks against Argon2i have actually been fixed.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.