So far, as I understand it, two ways to reduce the complexity of Argon2i have been found, one of which was fixed in Argon2 1.3, and one of which is still unfixed but is not a practical problem given enough Argon2i passes.
What I have not seen properly explained anywhere, is whether these weaknesses effect Argon2id, or if the combination is still good - basically, is the weakness in Argon2i enough to undermine the benefits of using it as the first half-pass of Argon2id, or do the passes of Argon2d after basically "cover" it somehow?
My naive intuition is at worst you lose the side-channel resistance, but does this compromise the side-channel resistance?
The weakness I am thinking of that is still applicable to Argon2 1.3 is the one described in "Towards Practical Attacks on Argon2i and Balloon Hashing"
Related to, but not a duplicate of this one, because while the comments and answer there suggest that
- argon2id 1.3 takes those known attacks into account, and
- argon2id is different enough from argon2i that it is probably safe to assume attacks on the latter do not apply to the former,
it is not clear to me that this actually fully covers my question, and certainly when I was looking for duplicate questions, it was not obvious to me that a question about "which one to choose?" would even touch upon my question - certainly the question as titled points in a completely different direction.