Questions tagged [argon2]

Argon2 is a password hash or password-based key derivation function, which won the password-hashing competition in 2015.

Filter by
Sorted by
Tagged with
0
votes
0answers
21 views

Should I use 2x the number of CPU / core for Argon2id parallelism?

I've read that I should use 2x the number of CPU available from some documentation while others suggest using between 1 and the number of CPU. I realize there is no hard answer here but I'm curious ...
1
vote
1answer
92 views

How to estimate the maximum computational cost bound for Key Derivation Functions (KDFs) before it becomes useless security-wise?

From my understanding of Key Derivation Functions (KDFs), e.g. scrypt, Argon2, etc, we can tune their parameters such that it eventually becomes harder for an attacker to brute force a password-to-key ...
1
vote
1answer
84 views

How to choose parameters for Argon2 for password vault

I'm creating a password vault and I'm planning on using Argon2id to derive the master key from the master password. For encryption I'm planning on using XChaCha20 with Poly1305. To be clear: a set of ...
0
votes
1answer
38 views

What are some of the alternatives to password based file encryption?

With the ever increasing risk of attackers compromising password based encryption by brute forcing or guessing passwords, are there alternatives to this traditional scheme of deriving encryption keys ...
0
votes
1answer
148 views

Choose Argon2i or Argon2id for secure password hashing on a website? [duplicate]

I make a website with authentication. I have studied a lot of answers to these questions, but I still don't understand what is better and safer to use for a website: Argon2i or Argon2id? I know which ...
0
votes
1answer
139 views

Can you correct my understanding of Argon2? [closed]

I'm a bit new to the cryptography field (completely new), and could really use your guidance. Please, correct my understanding, as defined by the following statements. The ...
6
votes
1answer
198 views

Is Argon2id safe from the discovered Argon2i issues?

So far, as I understand it, two ways to reduce the complexity of Argon2i have been found, one of which was fixed in Argon2 1.3, and one of which is still unfixed but is not a practical problem given ...
0
votes
0answers
77 views

Argon2id benchmarks

Recently I've decided to publish a simple app that I am using for maintaining and storing sensible encrypted data on the cloud. https://www.microsoft.com/store/apps/9NSGBQSJ2HD6 The hashing is done ...
1
vote
0answers
61 views

Signal Key Stretching Regarding Their Blog Post

I just read this blog post (Signal - Technology Preview for secure value recovery) by Signal and something is not quite clear to me. In section "Stretching beyond a KDF" they generate a ...
1
vote
2answers
133 views

Safest alternative for hashing credit card numbers to use the hash as fingerprint?

Same question asked here in 2014 but since a lot has changed since then, I would like to get feedback from experts on the latest best practices. The problem Our requirement is to provide the ...
9
votes
3answers
3k views

Using cryptographically random password as both the password and the salt

This question is theoretical, but will help with my understanding. All of my passwords are securely generated using 64 random letters (both uppercase and lowercase) and numbers. Using the argon2i ...
0
votes
2answers
165 views

Is it safe to use a deterministic salt as an input to KDF (Argon2)?

I'm prototyping an app that uses client-side password hashing in order to hide the "real" account password from a server (the server hashes any recieved password anyway, so no plaintext records in the ...
0
votes
1answer
353 views

Argon2 or scrypt instead of PBKDF2 with AES

Is using scrypt or argon2 a better key stretching technique with AES compared to PBKDF2 or bcrypt with regards to a quantum computer brute force attack. The brute force attack I'm referring to is ...
0
votes
0answers
106 views

How secure is Argon2ID with minimal parameters?

I am trying to make the login page faster by using low ram $hash = sodium_crypto_pwhash_str($password.$MAC, 1, 10240); My question is that I dont like login page ...
2
votes
1answer
78 views

Is iterative sha256 adequate for local password manager?

I'm fairly entry-level crypto; not a cryptographer by any stretch... I am at the level of ability to implement most of the traditional packages in python; the hashlib hashes and EAS, ECDSA ...
0
votes
2answers
109 views

Would XOR'ing two Argon2 keys add extra security?

When a user registers on the app, they need to provide a password they create and we provide them with a randomly generated passphrase (e.g. Apple Cat Ladder Fire). We then use Libsodium's ...
0
votes
1answer
373 views

migrate bcrypt -> argon2

We want to migrate our userbase from bcrypt to argon2. I was planning on an approach that migrates all hashes immediately to argon2; "old" users would have an argon2'd hash of their bcrypt hash of ...
0
votes
1answer
68 views

Hashing high entropy key into AES format

If I have a high entropy key (ECDHE shared secret), what type of hash should I use to format this into an AES-256 key? Is Sha256 or Sha3_256 sufficient to maintain entropy or do I need to use a KDF (...
1
vote
1answer
1k views

Encrypt a file with AES using a secret key derived with Argon2

I would like to encrypt some sensitive files on my computer and smartphone so that they remain unreadable even if the computer is stolen. So far as I'm concerned, AES is the best encryption algorithm,...
0
votes
1answer
44 views

Are HAIFA-construction based hash functions (e.g. Argon2) resistant to length-extension attacks?

Would a HAIFA-construction based hash function like Argon2 resistant to length-extension attacks? I say that Argon2 is HAIFA-based because BLAKE is, and Argon2 is based on BLAKE.
0
votes
0answers
45 views

Static Salt In Argon2 For Converting ECDH Shared Secret Into AES Key

I am using Argon2 to convert an ECDH exchange result into the correct format for AES-256 encryption. However the library that I am using for Argon2 requires a salt. Are there any weaknesses of using a ...
4
votes
2answers
1k views

Why cryptsetup default KDF is PBKDF2 and not Argon2(id)?

I plan to do a clean install of ArchLinux with Full Disk Encryption (with LUKS) but I'm not sure to understand the default KDF choice (PBKDF2+SHA-256). I didn't manage to find any pieces of evidence ...
2
votes
2answers
117 views

Optimal memory-hard KDF parameters when faced with small, slow memory

I am developing for a low-power embedded system. It has two ARM9 processors at 48 MHz each. One of the processors has access to 6 MiB of "fast" memory as well as access to 26 MiB of "slow" memory. The ...
12
votes
1answer
2k views

When to use Argon2i vs Argon2d vs Argon2id?

I've read the manual, and multiple articles / StackExchange posts about this topic, but still can't decide which implementation of Argon2 is best for my use case. I want to securely encrypt passwords ...
1
vote
2answers
924 views

Password Hashing Security Using Scrypt & Argon2

I am developing an app where the following cryptographic system will be in place: Elliptic Curve key exchange (curve: secp521r1) Double Scrypt the shared secret with different salts Pass this result ...
-1
votes
2answers
70 views

Can modern password hashing functions mathematically exclude parallel computation?

A recent password hashing competition set out the following detailed technical requirement:- that the API should include, but may not be limited to, a function with the following prototype: <...
3
votes
2answers
677 views

How difficult is it to guess a salt based on a hash and known plain text?

I have the following use case: Alice owns the domain alice.com and Bob owns bob.com. I want to users to create a hash for ...
6
votes
1answer
282 views

Argon2 parameters concurrent access

I am trying to figure out the best parameters for Argon2 for password hashing. I have read the RFC and the recommendations they put into it. So I follow up on the recommendation on the paper ...
7
votes
2answers
2k views

Argon2 for both password storage and key derivation

Is using Argon2 for both password storage and key derivation secure? I'm planning on using different salt values, of course. The basic concept is something like this: Alice has some secret data ($...
0
votes
1answer
243 views

argon2i hashes with GPU using JTR or any other tool please help!

I have been working on an assignment to solve argon2i hashes but unfortunately. I am not able to use GPU with JTR i.e. no opencl mode for argon2. Thus the speed is very slow. Any suggestion how to ...
4
votes
1answer
425 views

Reasonable Password Entropy given a certain Set of argon2 Parameters

I followed the recommendation of choosing threads, memory consumption and the number of iterations (in that order) on my machine. But now I wonder which passwords (by means of entropy) are actually ...
5
votes
1answer
171 views

Login security and plaintext of a password stored in Argon2i to derive a key via halite safe?

I'm using Symfony 4. I have set parameters on all my Argon2 stuff below so that it takes 1s per iteration. This website is supposed to encrypt HIPAA information. Basically I have a table like this <...
6
votes
0answers
953 views

Argon2 - memory setting - lower bound?

(I realise this is yet another Argon2 "how do I configure" question, but the existing questions I've found don't really help. If I've missed one, happy to have this closed). Deploying Argon2 (with ...
1
vote
0answers
449 views

Is Deterministic Ed25519 Key Derivation from Master Key and String Secure?

I am wanting to make deterministic (i.e. always the same for the same inputs) Ed25519 key from a master Ed25519 key and a target string (e.g. a website name, ala SQRL). My algorithm takes a 32-byte ...
1
vote
1answer
391 views

Safety of having many passwords hashed with the same salt?

I'm working on a web application where passwords must be hashed on the client before it can be send to the server. This is because the user's raw password is used for cryptography purposes and can't ...
6
votes
1answer
653 views

What is the difference between Argon2d and Argon2i?

I know that Argon2d accesses the memory array in a password dependent order and Argon2i accesses the memory array in a password independent order. What is the difference in computational complexity?
3
votes
1answer
282 views

Independently choose lanes and threads param on Argon2

I'm researching on using Argon2 on a JavaEE server-side application. I'm a bit reluctant to set the parallelism parameter larger than 1 on a JavaEE environment where threads are supposed to be ...
8
votes
2answers
4k views

Argon2 with SHA-256 instead of Blake2

Can SHA-256 be substituted for Blake2 in the Argon2 algorithm? I am working my way through the C reference source code for Argon2 and hand-translating it to Go. I was just wondering why Blake2 was ...
1
vote
2answers
523 views

Argon2id internal iterations vs multiple Argon2id calls ?

TLDR; Is there a security risk if rather than setting the iteration parameter to 12 (for example), we set it to 3 but call the function 4 times? I'm asking that for 2 reasons: Firstly, we use SRP ...
5
votes
1answer
229 views

Is the seed block in Argon2 (H0) 64-bit or 64-byte?

Is the H0 block in Argon2 64-bits, or 64-bytes? The RFC says bits: Establish H0 as the 64-bit value as shown below. But then it attempts to generate 64-bytes using Blake2 Background I'm trying ...
1
vote
1answer
511 views

scrypt and argon2: binary safe?

for bcrypt it's probably common knowledge that it isnt binary safe because it uses null termination, which means that when bcrypt is used you need to make sure that no one does these (e.g. by hashing ...
11
votes
1answer
5k views

argon2 vs scrypt

It's a fact that scrypt and argon2 are the two dominant memory hard KDFs. But which one of them is more recommendable for password hashing? scrypt is older and as far as I know resistant to almost ...
7
votes
3answers
8k views

Looking at hash output – is Base64 encoding in any way better than HEX encoding?

I was wondering why most "normal/unsafe" crypto hashes like SHA-256, SHA-512, Whirlpool, RipeMD-160, MD5, etc. are HEX encoded. But most "secure" crypto hashes (KDF' ) like ...
5
votes
2answers
497 views

Password derived hash to encrypt known plaintext as password check

The title sounds way too adventurous for what it actually is. I am currently building a system which features some encryption. There is already a system in place, which is built after that scheme if ...
5
votes
1answer
3k views

Questions about the argon2 options

So because I am currently working on a Project in which I will use Argon2 I need some answers to questions about the options of Argon2. I didn't find anything about them. What exactly does the ...
38
votes
1answer
13k views

Why use argon2i or argon2d if argon2id exists?

So I am currently working on a GitHub project of mine and I want to implement Argon2. The problem is that I dont really know a lot about it. Internet research is not really helpful, because Argon2 is ...
16
votes
3answers
3k views

Why did Argon2 win the PHC?

I've been reading up on Argon2 (and, to a lesser extent, other recent password hashers). I'm trying to understand why it won the competition versus the other finalists, like Catena, Lyra2, Makwa or ...
22
votes
0answers
723 views

Memory-hard password hash in practice?

Dan Boneh, Henry Corrigan-Gibbs, and Stuart Schechter have proposed Balloon Hashing: A Memory-Hard Function Providing Provable Protection Against Sequential Attacks (in proceedings of AsiaCrypt 2016). ...
6
votes
1answer
1k views

Argon2i versus Argon2d?

I am planning to use Argon2 in my Android app to encrypt some sensitive info that is only stored on the user's phone (in an SQLite DB) and not exported anywhere else. From documentation I see that ...
6
votes
1answer
349 views

What is the role played by cache misses in memory-hard password hashing?

I experiment with argon2 and build a web application. In browser, I use one threaded hashing with not too much memory. I want to protect my short length input data from parallel brute-force attack. I ...