Questions tagged [argon2]

Argon2 is a password hash or password-based key derivation function, which won the password-hashing competition in 2015.

Filter by
Sorted by
Tagged with
6 votes
1 answer
201 views

Secret sharing thresold scheme with small shares

Shamir secret sharing1 is a common method to split an arbitrary secret (login credentials, symmetric or private key) between $n$ persons, so that a threshold of $k$ persons is required to rebuild the ...
fgrieu's user avatar
  • 141k
2 votes
0 answers
87 views

Why does Argon2 truncate BLAKE2b outputs?

The Argon2 variable-length hash function uses BLAKE2b directly if the user requests an output less than or equal to 64 bytes in length. However, if the user requests an output longer than this, each ...
samuel-lucas6's user avatar
1 vote
0 answers
23 views

Argon2 confusion when computing J_1 and J_2

I'm implementing Argon2id from the RFC 9106 and I'm at the part where each thread computes J_1 and J_2 in order to generate indices [l] and [z]. I'm confused as to which TYPE (y = 0, 1 or 2) of Argon2 ...
Kevin Stefanov's user avatar
0 votes
0 answers
46 views

Entropy output from 256-bit Argon2 input [duplicate]

I would like to deterministically derive two different 256-bit keys from a single passphrase -- one used as an ECDSA private key, the other as a symmetric key for AES-GCM. Would a KDF output ...
Astrochamp's user avatar
1 vote
1 answer
54 views

python argon2-cffi salt is different than the one passed

Here's the code: salt = b'salt123123123' password = 'password123' hash_password = argon2.PasswordHasher().hash(password.encode('UTF-8'), salt = salt) Returns ...
Coffee's user avatar
  • 11
2 votes
0 answers
99 views

Why KeePassXC is deriving (stretching) the key again before saving changes to the database?

KeePassXC supports Argon2, which is great for security. However, there's a quirk that's been bothering me. Every time I save modifications to the database, it seems to stretch (derive) the key again, ...
Valentin Stoykov's user avatar
2 votes
1 answer
265 views

Is Argon2 based on BLAKE2b or is it only using the BLAKE2b at the end?

What's the exact meaning of 'Argon2 uses BLAKE2b'? Does it based on BLAKE2b? like chacha20 based on salsa20 kind of meaning or does Argon2 use the BLAKE2b with 12 rounds hash function at the end to ...
user avatar
1 vote
1 answer
225 views

How strong should my password manager's master password be?

I use an offline password manager, I want to use a future proof very strong master password and I'm going to choose one of these options from the EFF's large wordlist, a randomly chosen 8 word ...
Echo's user avatar
  • 11
1 vote
1 answer
359 views

Can I use Argon2 to encrypt data?

Normally I use Argon2 to generate an encryption key, and then use AES to encrypt data with that key. Can I just set the hash size to be equal to the data size, set the associated data to a random ...
Alice's user avatar
  • 11
2 votes
1 answer
342 views

Deriving secret keys vs generating and encrypting them

Suppose one has a password manager, based on symmetric cryptography, that requires a master passphrase to be unlocked. Argon2 is used for deriving a secret key from the master passphrase. I need ...
user2373145's user avatar
6 votes
1 answer
858 views

argon2, is there a security cost to raising the parallelism too high?

I'm experimenting with the parameters for argon2, using argon2_cffi. Whereas the iteration count or time_cost, and the memory_cost have obvious bearings on the speed and security of the result. I've ...
Neil_UK's user avatar
  • 408
0 votes
0 answers
1k views

How can I decode the salt of this argon2i passwordhash?

I have this password hash: $argon2i$v=19$m=128,t=2411,p=2$hmJvvpH3BZlvb2V1vLm/yf3zANU4qNpKuw5TBnGzo2I$<censored>. I know the password, and I want to verify if ...
trieulieuf9's user avatar
2 votes
2 answers
380 views

Designing a scheme to store encrypted data on a backend

My goal is to design an encryption scheme for the application so that the backend stores encrypted data and the whole process of encoding and decoding happens on the frontend. And you can be sure that ...
WardS's user avatar
  • 123
2 votes
1 answer
318 views

Benefit of salt in KDF like Argon2

I don't understand why I need a salt for Argon2 if Argon2 is only needed as a KDF for a password which is then called AES. At the end neither the password nor a password hash is stored. Only the data ...
user105538's user avatar
3 votes
1 answer
337 views

Using Argon2, can I improve the salt join the password Argon(password,password+salt)?

I'm creating an application where I'm going to use Argon2, I'm going to have a password, and I'm going to use as salt: email+name+date of birth, you must think that my salt is silly because name and ...
JRCDEV's user avatar
  • 33
1 vote
1 answer
391 views

Django password hashes in database

can someone explain to me why django saves the hash in the database asargon2$argon2id$v=19$m=102400,t=2,p=8$... and not ...
Gogu123's user avatar
  • 11
0 votes
2 answers
279 views

Argon2 derive two keys from one password

This is not a duplicate, I'm asking which method is better. I generate an encoded argon2 hash string, so it'll be stored in database to verify login passwords. Saved encoded hash has salt of length ...
koala's user avatar
  • 1
1 vote
0 answers
142 views

Wrap AES 256bit key with Argon2 without losing entropy

Given a random 256bit key used for data encryption with Streaming AES GCM I would like to wrap it for backup with AES GCM. Is it safe to use ...
zjmo's user avatar
  • 123
2 votes
1 answer
727 views

(How) can Argon2 be used to create both a hash for authentication and a secret key?

The Argon2 specs claim that Argon2 can be used both for password hashing and key derivation. I want to generate from a single password both a hash for authentication and a secret key to use for ...
BGWPVqRM3xIg's user avatar
1 vote
1 answer
1k views

Verifying Password Using Argon2

I am trying to develop a Rest API using Kotlin/Spring Boot. The JSON request in it, should have a hashed password that was done using Argon2id. Getting the password hashed was pretty straight forward ...
hell_storm2004's user avatar
1 vote
0 answers
1k views

What should argon2id parameters be

I plan to use it locally on mobile devices. These seems to do not offer computational power as good as on a server. So what could be a secure argon2id parameters that run around 1s since offline apps ...
Kim Mỹ's user avatar
  • 165
1 vote
1 answer
121 views

Will increasing timecost , memorycost , parallelism in argon2ID increase security in general?

currently I am using parameters for argon2ID in terms of timecost , memorycost , parallelism higher than what is recommended in RFC9106 https://www.rfc-editor.org/rfc/rfc9106.html for increased ...
ANISH M 18CS006's user avatar
1 vote
2 answers
470 views

Argon2id creating key for cryptography, how acceptable is it to use the same salt for the same encryption operation?

Everyone knows Argon2id is a slow hashing algorithm, and that's on purpose, all is good. When creating an Argon2id object a lot of parameters are needed to be taken into consideration ultimately ...
Elie-M's user avatar
  • 23
2 votes
0 answers
71 views

Could a Yubikey Provide the Optional Secret to OPAQUE When Using Argon2?

I've been studying the OPAQUE protocol, and I like it (so far). The RFC suggests using Argon2 as the Key-Stretching Function. Argon2 can take an optional "Secret value" (2, page 5). I had ...
Gavin D. Howard's user avatar
1 vote
0 answers
82 views

Performing client independent update of hash with Argon2

I'm trying to perform a hash update with updated parameters using argon2. According to Argon spec v3 (2.2.3 Client-indepentend Update, p. 9) the client independent ...
prohit's user avatar
  • 111
2 votes
1 answer
367 views

How to derive two keys from one password with Argon2id

I'd like to derive two independent 256 bit keys for symmetric encryption from a user password. I'm using Argon2id as the password-based key derivation function. I'm planning to do the following: ...
Agost Biro's user avatar
2 votes
0 answers
70 views

How does the indexing in Argon2 work?

I am reading the original paper of Argon2 authors and I can understand the algorithm except the indexing part. Can anyone explain two things: the indexing process and the mapping $J_{1}$, $J_{2}$ to ...
Mathslover shah's user avatar
2 votes
1 answer
1k views

Argon2 allows a huge key length in input, but does it really provide the security of the key provided?

I read the Argon2 specification. It says in 3.1 (Page #5): Secret value K (serves as key if necessary, but we do not assume any key use by default) may have any length from $0$ to $2^{32}\text{-}1$ ...
phantomcraft's user avatar
0 votes
1 answer
290 views

XChaCha20 With a Zeroed Nonce?

We know that for ChaCha20 and XChaCha20, the same key can never be used with the same nonce. But let's say I use a random 256-bit key every time... Then the nonce can be whatever because the key is ...
Evan Su's user avatar
  • 449
3 votes
1 answer
178 views

Questions: Argon2, its internal state and security of it when generating keys larger than 256/512 bits

Let's suppose I want to use a cipher with a large key size, such as ISAAC that supports 8192 bits ogf key. I can hash with sha-256 or sha-512 and iterate until reaches the key size but I won't get ...
phantomcraft's user avatar
2 votes
2 answers
3k views

How is Argon2 used for key derivation? [duplicate]

By my understanding, a key derivation is when you take some data, say a password, and use a function to convert it into a number that can be used as a secret key in say elliptic curve cryptography. ...
Manglemix's user avatar
1 vote
0 answers
170 views

How is the Argon2d side channel attack performed?

How should the adversary behave in order to perform a successful side channel attack against Argon2d? I'm trying to understand the scenario that Argon2i tries to resist against.
caveman's user avatar
  • 573
3 votes
1 answer
322 views

How is Argon2's Blake2b different than normal Blake2b?

This post says that Argon2's Blake2b is a reduced one, which is also agreed by Argon2's specs as it states that it uses only a 2 round Blake2b. But, on the other hand, page ...
caveman's user avatar
  • 573
1 vote
1 answer
116 views

How many times is Blake2b called with Argon2?

How many times is Blake2b called with Argon2? Say argon2 thisissomesalt -d -k 1048576 -p 4 -t 20.
caveman's user avatar
  • 573
1 vote
1 answer
758 views

What makes Argon2 also slow?

So as I understand Argon2 is a memory-hard function, in other words it has to use a certain amount of memory, thus making it effective against GPUs. So would this in theory, make Argon2 useless ...
Hormoz's user avatar
  • 789
1 vote
0 answers
223 views

Estimated hardware cost to crack ARGON2ID hashed passwords

I can find a bunch of information on stuff like bcrypt and script, but I am interested in estimating the cost per hash on something like Argon2id that is GPU hardened. I am trying to do the best with ...
Ian Reinhart Geiser's user avatar
6 votes
1 answer
2k views

Why does the GPU get a comparatively bigger advantage to the CPU when using higher parallelism in Argon2id?

My understanding is that the memory bandwidth of CPUs and GPUs is roughly one order of magnitude difference4, unlike cores which a GPU has many of and a CPU a handful. That is why PBKDF2-HMAC-SHA1 ...
Luc's user avatar
  • 1,508
1 vote
1 answer
297 views

Am I using these key derivation functions correctly?

I am a bit confused about key derivation functions. I am trying to use the argon2 KDF from the passlib python module to do the ...
HerpDerpington's user avatar
2 votes
0 answers
44 views

Does Argon2id provide less protection against side-channel attacks than Argon2i theoretically and/or practically? [duplicate]

LUKS 2 encryption uses Argon2i as the default PBKDF. As the key is used on each access, I guess side-channel attacks are a significant threat factor. However, as I'm not a cryptographer, I am not ...
Lyubomir's user avatar
  • 121
0 votes
2 answers
347 views

Encrypting cryptocurrency seeds for cold storage

I’d like some feedback on an encrypting algorithm. I’m not rolling my own, but even putting together well-proved pieces may create many pitfalls. (I don’t know if I'm stretching questioning in this ...
Vbakke's user avatar
  • 103
2 votes
2 answers
6k views

Is salt required in Argon2

I have software that generates user login keys randomly, we store the argon2 hash on our server. The generated keys are very strong, 64 pRNG hex characters. Right now we just use an empty string as ...
Albert Renshaw's user avatar
2 votes
0 answers
154 views

Encryption: filename + timestamp as info for HKDF-Expand

Let's assume that a user wants to symmetrically encrypt the files in one of his folders (being able to decrypt them later). For this, I have come up with the following procedure: A random 32 byte ...
setys's user avatar
  • 21
6 votes
0 answers
197 views

Is Argon2 "sequential memory hard"?

The Scrypt paper here defines memory-hard and sequential memory hard functions as follows: Definition 1. A memory-hard algorithm on a Random Access Machine is an algorithm which uses $S(n)$ space and ...
Modal Nest's user avatar
  • 1,443
1 vote
1 answer
396 views

What does "sequential memory-hard" mean?

I found this term in Scrypt's paper. I have several questions about its meaning, ranging from how to parse it, to theoretical bounds: Q1: How to parse it? Is it read ...
caveman's user avatar
  • 573
1 vote
0 answers
88 views

Should I use 2x the number of CPU / core for Argon2id parallelism?

I've read that I should use 2x the number of CPU available from some documentation while others suggest using between 1 and the number of CPU. I realize there is no hard answer here but I'm curious ...
Chance's user avatar
  • 111
2 votes
1 answer
324 views

How to estimate the maximum computational cost bound for Key Derivation Functions (KDFs) before it becomes useless security-wise?

From my understanding of Key Derivation Functions (KDFs), e.g. scrypt, Argon2, etc, we can tune their parameters such that it eventually becomes harder for an attacker to brute force a password-to-key ...
caveman's user avatar
  • 573
1 vote
1 answer
3k views

How to choose parameters for Argon2 for a password vault

I'm creating a password vault, and I plan to use Argon2id to derive the master key from the master password. For encryption, I plan to use XChaCha20 with Poly1305. To be clear: a set of multiple ...
SWdV's user avatar
  • 115
0 votes
1 answer
283 views

What are some of the alternatives to password based file encryption?

With the ever increasing risk of attackers compromising password based encryption by brute forcing or guessing passwords, are there alternatives to this traditional scheme of deriving encryption keys ...
Aravind A's user avatar
  • 1,020
0 votes
1 answer
1k views

Choose Argon2i or Argon2id for secure password hashing on a website? [duplicate]

I make a website with authentication. I have studied a lot of answers to these questions, but I still don't understand what is better and safer to use for a website: Argon2i or Argon2id? I know which ...
mkdir's user avatar
  • 1
0 votes
1 answer
705 views

Can you correct my understanding of Argon2? [closed]

I'm a bit new to the cryptography field (completely new), and could really use your guidance. Please, correct my understanding, as defined by the following statements. The ...
Ideator's user avatar