Skip to main content
3 of 4
added explanation of TMTO from the comments, improved formatting

Coming up with a specific number is hard. Realistically, all three options take you well out of the realm of ever having more than the absolute worst passwords brute-forced by an attacker.

The primary gain of scrypt and argon2 over bcrypt is a hit to parallelism due to the addition of memory requirements. GPUs with thousands of cores will need (but don't have) absurd amounts of memory, so most of those cores will need to remain idle. FPGAs and ASICs become much more expensive as they have to incorporate large amounts of memory, so you're really just forcing an attacker to trade a significantly larger number of dollars for equivalent parallelism.

The primary gains of argon2 over scrypt (someone correct me if I'm wrong):

  • improved resistance against Time Memory Trade-Off Attacks (TMTO),
  • better side-channel resistance (scrypt is vulnerable to cache-timing attacks due to secret-dependent memory access patterns), and
  • the ability to increase CPU and memory requirements independently of one-another.
Stephen Touset
  • 11.1k
  • 1
  • 39
  • 53