Is using scrypt or argon2 a better key stretching technique with AES compared to PBKDF2 or bcrypt with regards to a quantum computer brute force attack. The brute force attack I'm referring to is trying to generate keys from lets say a million passwords and trying them on an encrypted text to get the password. In other words, can a quantum computer scale up a memory intensive hash generation with scrypt or argon2 compared to PBKDF2 or bcrypt?


Such quantom attacks are entirely theoretical, we are nowhere near having quantom computers brute force passwords. It is thus difficult to compare. Argon2 might be harder to implement on quantom computers but also the others are so far from being practical it seems pointless to try and compare how these would fair against a mythical adversary. In general quantom computers can break passwords in a square root of the effort and that is true for all the mentioned algorithms.

However there are far more practical attacks to consider, mainly using GPUs and dedicated hardware. That is where the advantages of argon2 over bcrypt or PBKDF2-SHA1 for instance come into play. Argon2 requires not only CPU but also RAM, while the others hardly use memory. This deminishes the attacker advantage of dedicated hardware or GPUs.

I stillb consider bcrypt a safe option, but assuming you have available RAM you will get a better slowdown factor against a sophisticated adversary by using argon2.

| improve this answer | |
  • $\begingroup$ Bcrypt has a short max input limit, and so isn't suitable for use with particularly long passphrases. $\endgroup$ – SAI Peregrinus Jan 12 at 0:38
  • $\begingroup$ Quantum computing should be treated as a very serious threat and not as a mythical adversary. $\endgroup$ – Thunder Jan 13 at 12:05
  • $\begingroup$ @Thunder, Why so? They are very far from being practical, will require multiple breakthroughs in order to have sufficient Q bits, and be able to run sufficiently many operations. before we even talk about how fast they are. We are decades away at least, and possibly decoherence will never be solved. $\endgroup$ – Meir Maor Jan 13 at 12:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.