10

I am not a security guy but just curious about the things here.

I have seen several people in various answers here talked about the password hashing competition. Now that the winner is announced, I am just curious that not much about Argon2 is discussed in here.

What are your reviews of the Argon2 hashing method? How is it better/worse compared to the already in use methods like BCrypt, SCrypt and others. Is it going to take much longer before it can be judged?

  • 5
    We are a cautious lot who won't recommend a new technology until it has proven itself over many years. – Neil Smithline Dec 5 '15 at 23:54
  • 1
    I for one wouldn't use if for several years from now. – CodesInChaos Apr 7 '16 at 16:30
11

As of today, bcrypt, scrypt and PBKDF2 offer reasonable properties to be used and considered safe.

What is especially on their side is their history. As Neil pointed out in the comments, Argon2 - while winning the PHC - still has to prove itself, being researched extensively to be fairly sure nothing has been overlooked that can break its neck.

That's the reason established hash functions (and encryption systems) are preferred over new ones as long as they are still not feasible to break: They have been thoroughly researched and proven themselves over many years.

The people over at crypto.SE have some questions on Argon2 that may answer some of the more it-depth questions regarding comparisons and Argon2 itself.

Usually, it takes a few years for a new algorithm to become generally accepted after release - that's because reliable reviews require a great amount of research and time and the academic processes often involved are lengthy.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.