Questions tagged [argon2]

Argon2 is a key derivation function that was selected as the winner of the Password Hashing Competition in July 2015.

Filter by
Sorted by
Tagged with
8 votes
3 answers
3k views

Argon2 vs SHA-512, what's better in my case?

First I am very bad in cryptographic algorithms. I found online that Argon2 is more secure than SHA-512, so I used it for password hashing. There're recommended options for Argon2: Memory: 4Gb ...
user avatar
0 votes
2 answers
755 views

Does sending hashed password over url path parameter secure?

I need to create WebSocket authentication mechanism without using ticketing, so the whole authentication needs to be performed via HTTP (over SSL) GET request which is sent to upgrade connection to ...
user avatar
  • 103
5 votes
2 answers
2k views

Since GPUs have gigabytes of memory, does Argon2id need to use gigabytes of memory as well in order to effectively thwart GPU cracking?

The common advice of benchmarking a password hashing algorithm and choosing the slowest acceptable cost factor doesn't work for algorithms with more than one parameter: adding a lot of iterations at ...
user avatar
  • 31.8k
1 vote
3 answers
260 views

How does memory-hard hashing passwords protect against brute force attacks?

I have a background in web app development and I'm trying to up my security game but there are some things that I find confusing. Like how does memory-hard hashed passwords protect against brute force ...
user avatar
0 votes
1 answer
223 views

Is using Argon2 with a public random on client side a good idea to protect passwords in transit?

Not sure if things belongs in Crypto SE or here but anyway: I'm building an app and I'm trying to decide whatever is secure to protect user passwords in transit, in addition to TLS we already have. In ...
user avatar
2 votes
0 answers
205 views

Is it possible to use Argon2id hashes with PAM?

I was wondering if it's possible to implement more secure KDF like bcrypt, scrypt, pbkdf2 and argon2id in PAM authentication. Ideally I would like to have their hashes instead of SHA-512 ones directly ...
user avatar
  • 23
3 votes
1 answer
299 views

Configuring Argon2id for Multiple Threads

We're using argon2-jvm to use Argon2id on our Java TCP Server. Because its argon2id instance is thread-safe, we plan to only create a single instance for the lifetime of our app and have each request ...
user avatar
0 votes
1 answer
199 views

Configuring Argon2id for Multiple Threads [duplicate]

We're using argon2-jvm to use Argon2id on our Java TCP Server. Because its argon2id instance is thread-safe, we plan to only create a single instance for the lifetime of our app and have each request ...
user avatar
1 vote
1 answer
2k views

Argon2id Configuration

I read an article about how to use Argon2id in C# here. Below is the code they wrote (slightly edited): using System; using System.Diagnostics; using System.Linq; using System.Security.Cryptography; ...
user avatar
2 votes
1 answer
1k views

Storing Argon2id parameters in a database?

I've decided to use Argon2id for storing users' passwords in my database. I have two questions: Because there are several input parameters (parallelism, iterations etc.) that can influence the ...
user avatar
1 vote
1 answer
140 views

Argon2id key derivation rate calculation question

Just wanted to know if this was an accurate way of determining how long it would take someone with an 8GB GPU to derive 1 million keys using some assumed parameters below: Time per derivation............
user avatar
6 votes
1 answer
5k views

Which part of this encoded Argon2 hash is the salt?

I was reading the post Is it safe/wise to store a salt in the same field as the hashed password?: $argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$fPn4sPgkFAuBJo3M3UzcGss3dJysxLJdPdvojRF20ZE= ...
user avatar
5 votes
2 answers
728 views

Is it true that argon2i is "preferred for password hashing and key derivation"?

I was looking at the wiki for the node-argon2 package in npm, when I came around this justification for using argon2i as the default mode: The variant of the hash function. Argon2 has several ...
user avatar
49 votes
3 answers
14k views

Which is the best password hashing algorithm in .NET Core?

What are the considerations when picking the best password hashing algorithm in .NET Core? I read that not all hashing algorithms are compliant / unverified, so I am a hesitant on just getting ...
user avatar
  • 613
2 votes
1 answer
247 views

is it safe to AES encrypt the RSA private key and storing it in the database

i'm building an app that really needs encryption of this type , my question is it safe to store the aes encrypted RSA key in the database ? here is how i encrypt the key : i generate a random 256 ...
user avatar
1 vote
1 answer
163 views

Is it safe to use 2 password derivation functions to one password?

The example I'm working on is this: i store the user password using Argon2 in my database and then use PBKDF2 to derive an AES key from the user password , and store only the salt used in PBKDF2, i ...
user avatar
11 votes
1 answer
3k views

What are the minimum parameters for Argon2?

Argon2 is the winner of the Password Hashing competition, and currently recommended by OWASP for secure storage of passwords. One crucial step of Argon2 is determining the parameters used by the ...
user avatar
-4 votes
1 answer
282 views

encrypting file and user have public key to decrypt in barcode [closed]

I want code very secure system and I need some answers and help. Is this secure if encrypting file and it is possible decrypt with barcode/QRCode where is decryption key to view it. I've thinking of ...
user avatar
4 votes
2 answers
3k views

Appending a secret (pepper) to Argon2 password hashes

I've read quite a bit of the StackExchange and HackerNews debates on the user of "peppers" in password hash security. There are a number of different implementations of the idea of a pepper, ranging ...
user avatar
  • 402
1 vote
2 answers
517 views

Is there any advantage to combining a hash algorithm with a key-derivation function?

Let's assume I would like to secure passwords using a modern KDF such as Argon2. The flow of information would look like this: $hash,$salt = argon2id($password, $salt). Is there any advantage to ...
user avatar
  • 11
98 votes
1 answer
49k views

In 2018, what is the recommended hash to store passwords: bcrypt, scrypt, Argon2?

There are many questions about picking a hash function, including How to securely hash passwords? or Are there more modern password hashing methods than bcrypt and scrypt?, with very detailed answers, ...
user avatar
  • 3,315
66 votes
7 answers
17k views

Is it safe/wise to store a salt in the same field as the hashed password?

In using Argon2 for hashing passwords in my application, I've noticed it generates a string like this (e.g. for password "rabbit"): $argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$...
user avatar
3 votes
0 answers
151 views

Salt in argon2d as proof-of-work algorithm

I want to use argon2d as a proof-of-work algorithm. But as I know I can't use the algorithm without salt? Should I use a static salt for every task or generate new? Is it possible to increase ...
user avatar
  • 131
6 votes
1 answer
2k views

Source for up-to-date GPU/ASIC hash performance?

I am looking for CPU, GPU and/or ASIC performance stats on hash performance. Specifically SHA256 and Argon2i. I've googled and only came up with very limited anecdotal evidence. Considering that this ...
user avatar