29
$\begingroup$

I've read the manual, and multiple articles / StackExchange posts about this topic, but still can't decide which implementation of Argon2 is best for my use case.

I want to securely encrypt passwords in a database in an unshared environment. After first pass of the docs (pun-intended) it sounded like Argon2i is recommended in this case, but I feel like it's more likely for someone to gain access to the database directly and try to execute a GPU/ASIC/FPGA based attack to decrypt the data than someone gaining access to the network and attempting a side-channel attack.

I would like to prevent side-channel attacks if possible too, so that sounds like Argon2id is the way to go, but my understanding is the i-portion of the implementation only does one pass. Does the one pass really offer much protection against side-channel attacks (I read 3+ or even 10+ passes are needed to really secure Argon2i) and is there a way to increase the number of passes for the i-portion before the d-portion kicks in?

If Argon2id is the implementation for my use-case, but I can't increase the number of passes for the i-portion, would it make sense to effectively create my own "Argon2id" by implementing the Argon2i algorithm first, and then running the output through the Argon2d algorithm after?

Improve this question
$\endgroup$
4
  • $\begingroup$ Related: crypto.stackexchange.com/q/48935/54184 $\endgroup$
    – forest
    Commented Aug 7, 2019 at 5:02
  • 4
    $\begingroup$ Running Argon2 twice, giving each $\frac{t}{2}$ time, is basically less secure than running Argon2 once for $t$ time. (Same for any other split, not just 50-50.) The recommendation to first set the memory cost as high as possible and then set the number of passes as high as tolerable for that amount of memory is good advice. $\endgroup$
    – Future Security
    Commented Aug 8, 2019 at 19:52
  • 3
    $\begingroup$ Argon2id is its own algorithm. Caveats concerning Argon2i do not automatically apply to Argon2id. The newest documentation (Argon2 v 1.3) came after the TMTO discovered for a previous version of Argon2i. The newest designs and recommended method to choose parameters already takes the potential problem into account. $\endgroup$
    – Future Security
    Commented Aug 8, 2019 at 20:08
  • $\begingroup$ A side channel attack on a unshared environment can be performed via JavaScript. So, turn off your browser when doing key stretching (especially if you browse shady websites). But I think it's very unlikely. I can't think of other realistic side channel attacks on a normal PC (not a server). $\endgroup$
    – Valentin Stoykov
    Commented Oct 21, 2023 at 1:10

1 Answer 1

Reset to default
31
$\begingroup$

If you are unsure, then always choose Argon2id. Only choose Argon2d if you need maximum security at the expense of side-channel risk, and only choose Argon2i if side-channel attacks are the primary threat.

The number of passes just increases resistance to time-memory tradeoff attacks (TMTO). What you are probably remembering is that Argon2i is more vulnerable to TMTO attacks, and thus needs more passes to obtain the equivalent level of security. Argon2id uses the Argon2i pass to resist side-channel attacks, and the subsequent Argon2d passes to make up for TMTO resistance that the first pass lacks.

If an attacker performs a perfect side-channel attack and breaks the Argon2d portion, then they will still need to perform a very extensive TMTO attack to break the Argon2i passes. Compare this with pure Argon2d, where a successful side-channel attack completely negates its memory hardness. In other words, a side-channel attack against Argon2id reduces its security to that of one-pass Argon2i.

Note that some of the more severe TMTO attacks against Argon2i have actually been fixed.

Improve this answer
$\endgroup$
11
  • $\begingroup$ Let us continue this discussion in chat. $\endgroup$
    – forest
    Commented Jun 5, 2022 at 22:55
  • $\begingroup$ "What you are probably remembering is that Argon2d is more vulnerable to TMTO attacks..." Is there a typo? I thought it was Argon2i that is more vulnerable to TMTO attacks. $\endgroup$
    – Explorer09
    Commented Oct 25, 2022 at 6:00
  • 1
    $\begingroup$ @BeeGees I meant that a successful side-channel attack against the hybrid Argon2id reduces its security, but it doesn't make it any weaker than one-pass Argon2i. $\endgroup$
    – forest
    Commented Feb 9, 2023 at 5:51
  • 1
    $\begingroup$ @BeeGees If there could be a malicious program running on the computer at the same time that Argon2 is running, then a side-channel attack is relevant. If that's not the case (for example, you have an encrypted root partition and the computer is asking for the key at boot), then you can safely use Argon2d. If you will ever have, say, a web browser open at the same time that you input the password to Argon2, then it would be wise to use Argon2id. $\endgroup$
    – forest
    Commented Feb 10, 2023 at 1:52
  • 2
    $\begingroup$ @BeeGees Unless you have a specific reason not to, use Argon2id. For a password manager like that, yes, you should absolutely be using Argon2id. $\endgroup$
    – forest
    Commented Feb 14, 2023 at 0:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.