I plan to do a clean install of ArchLinux with Full Disk Encryption (with LUKS) but I'm not sure to understand the default KDF choice (PBKDF2+SHA-256).
I didn't manage to find any pieces of evidence that make PBKDF2 more recommendable than Argon2id. Can someone explain to me ?
In the cryptsetup FAQ, the maintainer says :
5.11 Some people say PBKDF2 is insecure?
There is some discussion that a hash-function should have a "large memory" property, i.e. that it should require a lot of memory to be computed. This serves to prevent attacks using special programmable circuits, like FPGAs, and attacks using graphics cards. PBKDF2 does not need a lot of memory and is vulnerable to these attacks. However, the publication usually referred in these discussions is not very convincing in proving that the presented hash really is "large memory" (that may change, email the FAQ maintainer when it does) and it is of limited usefulness anyways. Attackers that use clusters of normal PCs will not be affected at all by a "large memory" property. For example the US Secret Service is known to use the off-hour time of all the office PCs of the Treasury for password breaking. The Treasury has about 110'000 employees. Assuming every one has an office PC, that is significant computing power, all of it with plenty of memory for computing "large memory" hashes. Bot-net operators also have all the memory they want. The only protection against a resourceful attacker is a high-entropy passphrase, see items 5.9 and 5.10.
Is this point still valid? Can "memory-hard" KDF like Argon2id really "limit" the 2 examples above?
Even if the FAQ is still right, are there any downsides (security wise) of using Argon2id instead of PBKDF2?
PS : Not a native speaker. Sorry for possible language oddities.