Questions tagged [argon2]

Argon2 is a password hash or password-based key derivation function, which won the password-hashing competition in 2015.

Filter by
Sorted by
Tagged with
2 votes
0 answers
19 views

Could a Yubikey Provide the Optional Secret to OPAQUE When Using Argon2?

I've been studying the OPAQUE protocol, and I like it (so far). The RFC suggests using Argon2 as the Key-Stretching Function. Argon2 can take an optional "Secret value" (2, page 5). I had ...
user avatar
1 vote
0 answers
36 views

Performing client independent update of hash with Argon2

I'm trying to perform a hash update with updated parameters using argon2. According to Argon spec v3 (2.2.3 Client-indepentend Update, p. 9) the client independent ...
user avatar
  • 111
0 votes
0 answers
7 views

How to use Argon2 with salt from binary file? [migrated]

In the Linux program Argon2, we need to supply the salt in the command line. This limits the salt to be printable characters. How can we use a binary string as the ...
user avatar
  • 121
2 votes
1 answer
68 views

How to derive two keys from one password with Argon2id

I'd like to derive two independent 256 bit keys for symmetric encryption from a user password. I'm using Argon2id as the password-based key derivation function. I'm planning to do the following: ...
user avatar
1 vote
0 answers
33 views

How does the indexing in Argon2 work?

I am reading the original paper of Argon2 authors and I can understand the algorithm except the indexing part. Can anyone explain two things: the indexing process and the mapping $J_{1}$, $J_{2}$ to ...
user avatar
2 votes
1 answer
215 views

Argon2 allows a huge key length in input, but does it really provide the security of the key provided?

I read the Argon2 specification. It says in 3.1 (Page #5): Secret value K (serves as key if necessary, but we do not assume any key use by default) may have any length from $0$ to $2^{32}\text{-}1$ ...
user avatar
0 votes
1 answer
78 views

XChaCha20 With a Zeroed Nonce?

We know that for ChaCha20 and XChaCha20, the same key can never be used with the same nonce. But let's say I use a random 256-bit key every time... Then the nonce can be whatever because the key is ...
user avatar
  • 421
2 votes
1 answer
81 views

Questions: Argon2, its internal state and security of it when generating keys larger than 256/512 bits

Let's suppose I want to use a cipher with a large key size, such as ISAAC that supports 8192 bits ogf key. I can hash with sha-256 or sha-512 and iterate until reaches the key size but I won't get ...
user avatar
2 votes
2 answers
389 views

How is Argon2 used for key derivation? [duplicate]

By my understanding, a key derivation is when you take some data, say a password, and use a function to convert it into a number that can be used as a secret key in say elliptic curve cryptography. ...
user avatar
1 vote
0 answers
59 views

How is the Argon2d side channel attack performed?

How should the adversary behave in order to perform a successful side channel attack against Argon2d? I'm trying to understand the scenario that Argon2i tries to resist against.
user avatar
  • 519
1 vote
1 answer
98 views

How is Argon2's Blake2b different than normal Blake2b?

This post says that Argon2's Blake2b is a reduced one, which is also agreed by Argon2's specs as it states that it uses only a 2 round Blake2b. But, on the other hand, page ...
user avatar
  • 519
1 vote
1 answer
81 views

How many times is Blake2b called with Argon2?

How many times is Blake2b called with Argon2? Say argon2 thisissomesalt -d -k 1048576 -p 4 -t 20.
user avatar
  • 519
1 vote
1 answer
178 views

What makes Argon2 also slow?

So as I understand Argon2 is a memory-hard function, in other words it has to use a certain amount of memory, thus making it effective against GPUs. So would this in theory, make Argon2 useless ...
user avatar
  • 647
1 vote
0 answers
87 views

Estimated hardware cost to crack ARGON2ID hashed passwords

I can find a bunch of information on stuff like bcrypt and script, but I am interested in estimating the cost per hash on something like Argon2id that is GPU hardened. I am trying to do the best with ...
user avatar
4 votes
1 answer
223 views

Why does the GPU get a comparatively bigger advantage to the CPU when using higher parallelism in Argon2id?

My understanding is that the memory bandwidth of CPUs and GPUs is roughly one order of magnitude difference4, unlike cores which a GPU has many of and a CPU a handful. That is why PBKDF2-HMAC-SHA1 ...
user avatar
  • 1,386
1 vote
1 answer
114 views

Am I using these key derivation functions correctly?

I am a bit confused about key derivation functions. I am trying to use the argon2 KDF from the passlib python module to do the ...
user avatar
2 votes
0 answers
33 views

Does Argon2id provide less protection against side-channel attacks than Argon2i theoretically and/or practically? [duplicate]

LUKS 2 encryption uses Argon2i as the default PBKDF. As the key is used on each access, I guess side-channel attacks are a significant threat factor. However, as I'm not a cryptographer, I am not ...
user avatar
0 votes
2 answers
161 views

Encrypting cryptocurrency seeds for cold storage

I’d like some feedback on an encrypting algorithm. I’m not rolling my own, but even putting together well-proved pieces may create many pitfalls. (I don’t know if I'm stretching questioning in this ...
user avatar
  • 103
1 vote
2 answers
2k views

Is salt required in Argon2

I have software that generates user login keys randomly, we store the argon2 hash on our server. The generated keys are very strong, 64 pRNG hex characters. Right now we just use an empty string as ...
user avatar
1 vote
0 answers
49 views

Encryption: filename + timestamp as info for HKDF-Expand

Let's assume that a user wants to symmetrically encrypt the files in one of his folders (being able to decrypt them later). For this, I have come up with the following procedure: A random 32 byte ...
user avatar
  • 11
6 votes
0 answers
145 views

Is Argon2 "sequential memory hard"?

The Scrypt paper here defines memory-hard and sequential memory hard functions as follows: Definition 1. A memory-hard algorithm on a Random Access Machine is an algorithm which uses $S(n)$ space and ...
user avatar
  • 1,423
1 vote
1 answer
327 views

What does "sequential memory-hard" mean?

I found this term in Scrypt's paper. I have several questions about its meaning, ranging from how to parse it, to theoretical bounds: Q1: How to parse it? Is it read ...
user avatar
  • 519
1 vote
0 answers
46 views

Should I use 2x the number of CPU / core for Argon2id parallelism?

I've read that I should use 2x the number of CPU available from some documentation while others suggest using between 1 and the number of CPU. I realize there is no hard answer here but I'm curious ...
user avatar
  • 111
2 votes
1 answer
210 views

How to estimate the maximum computational cost bound for Key Derivation Functions (KDFs) before it becomes useless security-wise?

From my understanding of Key Derivation Functions (KDFs), e.g. scrypt, Argon2, etc, we can tune their parameters such that it eventually becomes harder for an attacker to brute force a password-to-key ...
user avatar
  • 519
1 vote
1 answer
968 views

How to choose parameters for Argon2 for a password vault

I'm creating a password vault, and I plan to use Argon2id to derive the master key from the master password. For encryption, I plan to use XChaCha20 with Poly1305. To be clear: a set of multiple ...
user avatar
  • 115
0 votes
1 answer
139 views

What are some of the alternatives to password based file encryption?

With the ever increasing risk of attackers compromising password based encryption by brute forcing or guessing passwords, are there alternatives to this traditional scheme of deriving encryption keys ...
user avatar
0 votes
1 answer
1k views

Choose Argon2i or Argon2id for secure password hashing on a website? [duplicate]

I make a website with authentication. I have studied a lot of answers to these questions, but I still don't understand what is better and safer to use for a website: Argon2i or Argon2id? I know which ...
user avatar
  • 1
0 votes
1 answer
483 views

Can you correct my understanding of Argon2? [closed]

I'm a bit new to the cryptography field (completely new), and could really use your guidance. Please, correct my understanding, as defined by the following statements. The ...
user avatar
6 votes
1 answer
743 views

Is Argon2id safe from the discovered Argon2i issues?

So far, as I understand it, two ways to reduce the complexity of Argon2i have been found, one of which was fixed in Argon2 1.3, and one of which is still unfixed but is not a practical problem given ...
user avatar
  • 287
0 votes
0 answers
179 views

Argon2id benchmarks

Recently I've decided to publish a simple app that I am using for maintaining and storing sensible encrypted data on the cloud. https://www.microsoft.com/store/apps/9NSGBQSJ2HD6 The hashing is done ...
user avatar
1 vote
0 answers
93 views

Signal Key Stretching Regarding Their Blog Post

I just read this blog post (Signal - Technology Preview for secure value recovery) by Signal and something is not quite clear to me. In section "Stretching beyond a KDF" they generate a ...
user avatar
1 vote
2 answers
336 views

Safest alternative for hashing credit card numbers to use the hash as fingerprint?

Same question asked here in 2014 but since a lot has changed since then, I would like to get feedback from experts on the latest best practices. The problem Our requirement is to provide the ...
user avatar
9 votes
3 answers
3k views

Using cryptographically random password as both the password and the salt

This question is theoretical, but will help with my understanding. All of my passwords are securely generated using 64 random letters (both uppercase and lowercase) and numbers. Using the argon2i ...
user avatar
  • 193
0 votes
2 answers
511 views

Is it safe to use a deterministic salt as an input to KDF (Argon2)?

I'm prototyping an app that uses client-side password hashing in order to hide the "real" account password from a server (the server hashes any recieved password anyway, so no plaintext records in the ...
user avatar
1 vote
1 answer
1k views

Argon2 or scrypt instead of PBKDF2 with AES

Is using scrypt or argon2 a better key stretching technique with AES compared to PBKDF2 or bcrypt with regards to a quantum computer brute force attack. The brute force attack I'm referring to is ...
user avatar
  • 111
0 votes
0 answers
273 views

How secure is Argon2ID with minimal parameters?

I am trying to make the login page faster by using low ram $hash = sodium_crypto_pwhash_str($password.$MAC, 1, 10240); My question is that I dont like login page ...
user avatar
2 votes
1 answer
113 views

Is iterative sha256 adequate for local password manager?

I'm fairly entry-level crypto; not a cryptographer by any stretch... I am at the level of ability to implement most of the traditional packages in python; the hashlib hashes and EAS, ECDSA ...
user avatar
0 votes
2 answers
140 views

Would XOR'ing two Argon2 keys add extra security?

When a user registers on the app, they need to provide a password they create and we provide them with a randomly generated passphrase (e.g. Apple Cat Ladder Fire). We then use Libsodium's ...
user avatar
0 votes
1 answer
748 views

migrate bcrypt -> argon2

We want to migrate our userbase from bcrypt to argon2. I was planning on an approach that migrates all hashes immediately to argon2; "old" users would have an argon2'd hash of their bcrypt hash of ...
user avatar
  • 103
0 votes
1 answer
116 views

Hashing high entropy key into AES format

If I have a high entropy key (ECDHE shared secret), what type of hash should I use to format this into an AES-256 key? Is Sha256 or Sha3_256 sufficient to maintain entropy or do I need to use a KDF (...
user avatar
  • 593
5 votes
1 answer
3k views

Encrypt a file with AES using a secret key derived with Argon2

I would like to encrypt some sensitive files on my computer and smartphone so that they remain unreadable even if the computer is stolen. So far as I'm concerned, AES is the best encryption algorithm,...
user avatar
0 votes
1 answer
58 views

Are HAIFA-construction based hash functions (e.g. Argon2) resistant to length-extension attacks?

Would a HAIFA-construction based hash function like Argon2 resistant to length-extension attacks? I say that Argon2 is HAIFA-based because BLAKE is, and Argon2 is based on BLAKE.
user avatar
0 votes
0 answers
68 views

Static Salt In Argon2 For Converting ECDH Shared Secret Into AES Key

I am using Argon2 to convert an ECDH exchange result into the correct format for AES-256 encryption. However the library that I am using for Argon2 requires a salt. Are there any weaknesses of using a ...
user avatar
  • 593
5 votes
2 answers
3k views

Why cryptsetup default KDF is PBKDF2 and not Argon2(id)?

I plan to do a clean install of ArchLinux with Full Disk Encryption (with LUKS) but I'm not sure to understand the default KDF choice (PBKDF2+SHA-256). I didn't manage to find any pieces of evidence ...
user avatar
  • 171
2 votes
2 answers
208 views

Optimal memory-hard KDF parameters when faced with small, slow memory

I am developing for a low-power embedded system. It has two ARM9 processors at 48 MHz each. One of the processors has access to 6 MiB of "fast" memory as well as access to 26 MiB of "...
user avatar
  • 13.3k
17 votes
1 answer
7k views

When to use Argon2i vs Argon2d vs Argon2id?

I've read the manual, and multiple articles / StackExchange posts about this topic, but still can't decide which implementation of Argon2 is best for my use case. I want to securely encrypt passwords ...
user avatar
  • 273
1 vote
2 answers
1k views

Password Hashing Security Using Scrypt & Argon2

I am developing an app where the following cryptographic system will be in place: Elliptic Curve key exchange (curve: secp521r1) Double Scrypt the shared secret with different salts Pass this result ...
user avatar
  • 593
0 votes
2 answers
83 views

Can modern password hashing functions mathematically exclude parallel computation?

A recent password hashing competition set out the following detailed technical requirement:- that the API should include, but may not be limited to, a function with the following prototype: <...
user avatar
  • 13.9k
3 votes
2 answers
955 views

How difficult is it to guess a salt based on a hash and known plain text?

I have the following use case: Alice owns the domain alice.com and Bob owns bob.com. I want to users to create a hash for ...
user avatar
6 votes
1 answer
497 views

Argon2 parameters concurrent access

I am trying to figure out the best parameters for Argon2 for password hashing. I have read the RFC and the recommendations they put into it. So I follow up on the recommendation on the paper ...
user avatar
  • 61