3

Referencing this document, they give justifications for a number of their recommendations, but not any behind only going with 1 degree of parallelism for using Argon2id. Is there a reason why this is recommended that is unmentioned there?

1 Answer 1

5

The recommendation was introduced with a commit which references a GitHub comment. In that comment, the author gives the following reason for recommending a parallelism of 1:

For authentication you should use p=1 because a lot of people are running a VPS with a single CPU core. Even if not, one could benchmark this and think they can go higher on settings than they should because they are not thinking about throughput. Also with memory hard algorithms, it would be wise to limit the number of simultaneous instances of Argon2. An attacker can likely send more requests per second than a server to do. Which will make the server exhaust all memory if there isn't a limit.

Of course this is more a rule of thumb than some deep cryptographic insight. You absolutely can and should fine-tune the parameters for your specific hardware and use case.

In the original Argon2 paper, the authors suggest using the number of available threads or twice the number of cores (on a CPU with hyperthreading, apparently). However, the above comment makes a good point about simultaneous authentication requests. Maxing out the parameters makes sense in an offline scenario with only one user at a time, but in a web application, you have to be careful not to overwhelm the system with parallel hash calculations. This is also important for avoiding denial-of-service attacks (which are sometimes forgotten when talking about password hashes).

1
  • So, we have a two-sided blade. More security on one side and generating easy resource-consuming attack points on the other side.
    – kelalaka
    Commented Apr 26 at 17:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .