39
votes
Accepted
Why use argon2i or argon2d if argon2id exists?
The current Argon2 draft RFC, I think, provides a good, reasonably brief answers to this question. TL;DR: most people will indeed want to use Argon2id and not the "pure" variants.
The ...
- 14.7k
33
votes
Accepted
Looking at hash output – is Base64 encoding in any way better than HEX encoding?
The algorithms themselves just output binary (i.e. bytes) if you read their specifications. It's the implementation in API's and applications that output the hexadecimals and/or base64.
Sometimes ...
- 94.5k
31
votes
Accepted
When to use Argon2i vs Argon2d vs Argon2id?
If you are unsure, then always choose Argon2id. Only choose Argon2d if you need maximum security at the expense of side-channel risk, and only choose Argon2i if side-channel attacks are the primary ...
- 15.5k
29
votes
Looking at hash output – is Base64 encoding in any way better than HEX encoding?
Using Base64/HEX has nothing to do with security of a hash algorithm.
Base64 and HEX are ways to represent binary data, which is the actual output of a hash algorithm.
Base64 is shorter simple ...
- 436
26
votes
Accepted
Storing Parameters In Argon2 Hash As Potential Security Issue?
First, following the "next big thing" is not generally a good idea in the world of cryptography. You should strongly prefer battle-tested code and algorithms over new ones. In this particular case, ...
- 11.1k
25
votes
Accepted
Using cryptographically random password as both the password and the salt
The whole point of a salt is to be unique to a set-password operation, so that attackers can't reuse work when they target multiple accounts (multiple users on the same server, multiple servers, or ...
18
votes
Accepted
Why did Argon2 win the PHC?
I have been part of several cryptographic competitions (AES, eSTREAM, SHA-3, PHC). In every single one of them, some people worded bitter reproaches and wailed and whined about the unfairness of the ...
- 87.8k
15
votes
Accepted
Argon2 with SHA-256 instead of Blake2
If you take a look at the Password Hashing Competiton, you can see, that most of the schemes use Blake2b, some of them uses SHA-512, none of them uses SHA-256.
Blake2b is optimized for 64-bit ...
- 995
13
votes
Accepted
Questions about the argon2 options
The entire point of a key-derivation function like Argon2 is to increase the time (difficulty) it takes to create a key, and as a side effect, increase the resources required to attack the key.
The ...
- 268
12
votes
Why did Argon2 win the PHC?
I agree with Thomas Pornins answer, but there was one remarkable criticism on the panel. Round two of the competition actually allowed only minor tweaks. Argon switched to Argon2, which was more a new ...
- 995
12
votes
Password Hashing Security Using Scrypt & Argon2
This home-made construction is pointless and unnecessarily complex, Complexity is often the source of vulnerabilities. In this case, for example, I’ll wager you’re not securely handling the ...
- 2,297
11
votes
Accepted
Argon2i versus Argon2d?
TL;DR: You want to use Argon2d here.
Even though Argon2 was standardized only somewhat recently, it is the result of the Password-Hashing Competition (2013-2015) and was a late re-design of Argon ...
- 46.4k
11
votes
Using cryptographically random password as both the password and the salt
Gilles already explained it sufficiently but using a unique salt brings another advantage: Users with identical passwords will not have identical hashes stored in the database. Unfortunately not all ...
- 6,511
10
votes
Accepted
Whats the deal with argon2?
It has been implemented, of course. In addition to the reference implementation, there are some crypto libraries with it like libsodium.
It has not yet seen much use in applications or protocols, ...
- 32.4k
10
votes
Is it necessary to worry about timing attacks when comparing SHA256 or Argon2 hashes?
Comparing hashes of strings does not fully defeat timing attacks.
For example, if we try to find a password by timing attack of
...
- 146k
9
votes
Is it better to maximize memory usage or number of passes with Argon2i 1.3?
As of October 2017, the resource I've found most useful for getting a quick, practical sense of how pick parameters for Argon2 is the (still draft) RFC, in particular section 9, which gives this ...
- 14.7k
8
votes
Why did Argon2 win the PHC?
Some resources:
The Argon2: paper and GitHub repo
Catena: paper, a good thesis and GitHub repo
Makwa: paper
Yescrypt: paper
Lyra2: paper and GitHub repo
A GitHub repository with round 1 submissions
A ...
- 181
8
votes
Accepted
What is the difference between Argon2d and Argon2i?
As @sejpm already hinted in his comment: both scale the same when it comes to the parameters.
You might still want to read the RFC to get the complete picture, but the general differences can be ...
- 18.1k
8
votes
Accepted
Argon2 - memory setting - lower bound?
An RFC for Argon2 has been published now, which provides several recommendations. Unfortunately, the situation is still not clear cut and seems unrealistic.
Their two generally recommended options are:...
- 2,120
8
votes
Accepted
Argon2 for both password storage and key derivation
Should the secret data be encrypted with Alice's raw password?
As a general rule of thumb:
A password should only ever be fed into a password hashing scheme (PHS) such as Argon2, scrypt or bcrypt, ...
- 46.4k
7
votes
Accepted
argon2 vs scrypt
As far as I read, scrypt can be used for some time/memory tradeoffs where you save memory but take more computations, which may truly be an annoying thing.
Argon2d uses data dependent on the input (i....
- 340
7
votes
Accepted
How to configure Argon2d for commodity hardware?
The first thing to note is that KeePass uses Argon2d which is the Argon2-variant with data-dependent memory access.
Now it's best to (roughly) follow the guidelines lined out in the Argon2 ...
- 46.4k
7
votes
Password Hashing Security Using Scrypt & Argon2
You are using the KDF wrong. The only purpose of Argon2 and scrypt (and related constructions like bcrypt and PBKDF2) is to slow down dictionary and brute force attacks against passwords created by ...
- 15.5k
7
votes
Accepted
Encrypt a file with AES using a secret key derived with Argon2
Which of the two types of Argon2 is the best for password-based key derivation?
In short, as said by draft-irtf-cfrg-argon2-03;
If you do not know the difference between them or you consider side-...
- 49.5k
7
votes
Is salt required in Argon2
If you use a fixed salt all your passwords can be attacked concurrently.
Though argon2 is designed to be slow and thus hard to do a dictionary attack I see no reason to give your attacker a speedup ...
- 12k
6
votes
Why do two Argon hashes with the same password differ?
This function returns a string that the verification function will consider valid when given the same password.
You shouldn't have to care about what the string actually contains. If only because the ...
- 3,053
6
votes
Storing Parameters In Argon2 Hash As Potential Security Issue?
The theory of password hashing assumes that the attacker knows the function used to hash every single password entry. The function is designed to slow down an attacker who knows the parameters. So ...
- 14.7k
6
votes
Using cryptographically random password as both the password and the salt
I'm not sure I understand the question (mostly because I don't understand what you mean with "supply this long random password for both the message and the salt"), but if you supply the password as ...
- 160
6
votes
Secret sharing thresold scheme with small shares
I will describe the classical (and simple) approach proposed by Krawczyk in:
Hugo Krawczyk, Secret Sharing Made Short, CRYPTO 1993
It is a $t$-out-of-$n$ threshold scheme. When the secret has $\ell$ ...
- 14.5k
5
votes
What is the recommended number of iterations for Argon2?
As was mentioned, cryptography and hashing require a balance between security and usability. If you set the security too high, the user will be put off and avoid using your OS. If you set it too low, ...
Only top scored, non community-wiki answers of a minimum length are eligible