Skip to main content
38 votes
Accepted

Why use argon2i or argon2d if argon2id exists?

The current Argon2 draft RFC, I think, provides a good, reasonably brief answers to this question. TL;DR: most people will indeed want to use Argon2id and not the "pure" variants. The ...
Luis Casillas's user avatar
33 votes
Accepted

Looking at hash output – is Base64 encoding in any way better than HEX encoding?

The algorithms themselves just output binary (i.e. bytes) if you read their specifications. It's the implementation in API's and applications that output the hexadecimals and/or base64. Sometimes ...
Maarten Bodewes's user avatar
  • 93.2k
29 votes

Looking at hash output – is Base64 encoding in any way better than HEX encoding?

Using Base64/HEX has nothing to do with security of a hash algorithm. Base64 and HEX are ways to represent binary data, which is the actual output of a hash algorithm. Base64 is shorter simple ...
DDoSolitary's user avatar
29 votes
Accepted

When to use Argon2i vs Argon2d vs Argon2id?

If you are unsure, then always choose Argon2id. Only choose Argon2d if you need maximum security at the expense of side-channel risk, and only choose Argon2i if side-channel attacks are the primary ...
forest's user avatar
  • 15.3k
28 votes
Accepted

Argon2 output length and parameter storage?

You need to consider the weakest link property: a security system is never stronger than its weakest link. Since Argon2 is a password-based function, the weak link here is going to be the strength of ...
Luis Casillas's user avatar
26 votes
Accepted

Storing Parameters In Argon2 Hash As Potential Security Issue?

First, following the "next big thing" is not generally a good idea in the world of cryptography. You should strongly prefer battle-tested code and algorithms over new ones. In this particular case, ...
Stephen Touset's user avatar
25 votes
Accepted

What is the recommended number of iterations for Argon2?

I'm wondering what the recommended number of iterations would be? Unlike bcrypt or traditional crypt, argon2 does not have a single iteration count, but three parameters affecting the computational ...
otus's user avatar
  • 32.2k
25 votes
Accepted

Using cryptographically random password as both the password and the salt

The whole point of a salt is to be unique to a set-password operation, so that attackers can't reuse work when they target multiple accounts (multiple users on the same server, multiple servers, or ...
Gilles 'SO- stop being evil''s user avatar
19 votes
Accepted

Does the Balloon hashing paper deprecate Argon2?

Does the recent Balloon hashing paper and the included attack on Argon2 effectively negate the result of the Password Hashing Competition? No. The main result of the PHC was not a single new ...
SEJPM's user avatar
  • 46.1k
18 votes
Accepted

Why did Argon2 win the PHC?

I have been part of several cryptographic competitions (AES, eSTREAM, SHA-3, PHC). In every single one of them, some people worded bitter reproaches and wailed and whined about the unfairness of the ...
Thomas Pornin's user avatar
15 votes
Accepted

Argon2 with SHA-256 instead of Blake2

If you take a look at the Password Hashing Competiton, you can see, that most of the schemes use Blake2b, some of them uses SHA-512, none of them uses SHA-256. Blake2b is optimized for 64-bit ...
BeloumiX's user avatar
  • 995
13 votes
Accepted

Questions about the argon2 options

The entire point of a key-derivation function like Argon2 is to increase the time (difficulty) it takes to create a key, and as a side effect, increase the resources required to attack the key. The ...
BinaryEvolved's user avatar
12 votes

Why did Argon2 win the PHC?

I agree with Thomas Pornins answer, but there was one remarkable criticism on the panel. Round two of the competition actually allowed only minor tweaks. Argon switched to Argon2, which was more a new ...
BeloumiX's user avatar
  • 995
12 votes

Password Hashing Security Using Scrypt & Argon2

This home-made construction is pointless and unnecessarily complex, Complexity is often the source of vulnerabilities. In this case, for example, I’ll wager you’re not securely handling the ...
rmalayter's user avatar
  • 2,297
11 votes
Accepted

Argon2i versus Argon2d?

TL;DR: You want to use Argon2d here. Even though Argon2 was standardized only somewhat recently, it is the result of the Password-Hashing Competition (2013-2015) and was a late re-design of Argon ...
SEJPM's user avatar
  • 46.1k
11 votes

Using cryptographically random password as both the password and the salt

Gilles already explained it sufficiently but using a unique salt brings another advantage: Users with identical passwords will not have identical hashes stored in the database. Unfortunately not all ...
AleksanderCH's user avatar
  • 6,462
10 votes
Accepted

Whats the deal with argon2?

It has been implemented, of course. In addition to the reference implementation, there are some crypto libraries with it like libsodium. It has not yet seen much use in applications or protocols, ...
otus's user avatar
  • 32.2k
9 votes

Is it necessary to worry about timing attacks when comparing SHA256 or Argon2 hashes?

Comparing hashes of strings does not fully defeat timing attacks. For example, if we try to find a password by timing attack of ...
fgrieu's user avatar
  • 142k
9 votes

Is it better to maximize memory usage or number of passes with Argon2i 1.3?

As of October 2017, the resource I've found most useful for getting a quick, practical sense of how pick parameters for Argon2 is the (still draft) RFC, in particular section 9, which gives this ...
Luis Casillas's user avatar
8 votes
Accepted

What is the difference between Argon2d and Argon2i?

As @sejpm already hinted in his comment: both scale the same when it comes to the parameters. You might still want to read the RFC to get the complete picture, but the general differences can be ...
e-sushi's user avatar
  • 18k
8 votes
Accepted

Argon2 - memory setting - lower bound?

An RFC for Argon2 has been published now, which provides several recommendations. Unfortunately, the situation is still not clear cut and seems unrealistic. Their two generally recommended options are:...
samuel-lucas6's user avatar
8 votes
Accepted

Argon2 for both password storage and key derivation

Should the secret data be encrypted with Alice's raw password? As a general rule of thumb: A password should only ever be fed into a password hashing scheme (PHS) such as Argon2, scrypt or bcrypt, ...
SEJPM's user avatar
  • 46.1k
7 votes

Why did Argon2 win the PHC?

Some resources: The Argon2: paper and GitHub repo Catena: paper, a good thesis and GitHub repo Makwa: paper Yescrypt: paper Lyra2: paper and GitHub repo A GitHub repository with round 1 submissions A ...
alisianoi's user avatar
  • 171
7 votes
Accepted

How to configure Argon2d for commodity hardware?

The first thing to note is that KeePass uses Argon2d which is the Argon2-variant with data-dependent memory access. Now it's best to (roughly) follow the guidelines lined out in the Argon2 ...
SEJPM's user avatar
  • 46.1k
7 votes
Accepted

argon2 vs scrypt

As far as I read, scrypt can be used for some time/memory tradeoffs where you save memory but take more computations, which may truly be an annoying thing. Argon2d uses data dependent on the input (i....
My1's user avatar
  • 330
7 votes

Password Hashing Security Using Scrypt & Argon2

You are using the KDF wrong. The only purpose of Argon2 and scrypt (and related constructions like bcrypt and PBKDF2) is to slow down dictionary and brute force attacks against passwords created by ...
forest's user avatar
  • 15.3k
7 votes
Accepted

Encrypt a file with AES using a secret key derived with Argon2

Which of the two types of Argon2 is the best for password-based key derivation? In short, as said by draft-irtf-cfrg-argon2-03; If you do not know the difference between them or you consider side-...
kelalaka's user avatar
  • 49k
6 votes

Storing Parameters In Argon2 Hash As Potential Security Issue?

The theory of password hashing assumes that the attacker knows the function used to hash every single password entry. The function is designed to slow down an attacker who knows the parameters. So ...
Luis Casillas's user avatar
6 votes
Accepted

Are coprocessors (Intel Phi) a threat for modern key stretching functions?

The key idea of memory-hard functions like scrypt and Argon2, as I understand them, is to analyze the cost to the attacker in terms of a time-area product. Time is how much time the attacker spends. ...
Luis Casillas's user avatar
6 votes

Why do two Argon hashes with the same password differ?

This function returns a string that the verification function will consider valid when given the same password. You shouldn't have to care about what the string actually contains. If only because the ...
Frank Denis's user avatar
  • 2,973

Only top scored, non community-wiki answers of a minimum length are eligible