Questions tagged [argon2]
Argon2 is a key derivation function that was selected as the winner of the Password Hashing Competition in July 2015.
22
questions
0
votes
3answers
116 views
How does memory-hard hashing passwords protect against brute force attacks?
I have a background in web app development and I'm trying to up my security game but there are some things that I find confusing.
Like how does memory-hard hashed passwords protect against brute force ...
0
votes
1answer
101 views
Is using Argon2 with a public random on client side a good idea to protect passwords in transit?
Not sure if things belongs in Crypto SE or here but anyway:
I'm building an app and I'm trying to decide whatever is secure to protect user passwords in transit, in addition to TLS we already have.
In ...
2
votes
0answers
74 views
Is it possible to use Argon2id hashes with PAM?
I was wondering if it's possible to implement more secure KDF like bcrypt, scrypt, pbkdf2 and argon2id in PAM authentication.
Ideally I would like to have their hashes instead of SHA-512 ones directly ...
3
votes
1answer
87 views
Configuring Argon2id for Multiple Threads
We're using argon2-jvm to use Argon2id on our Java TCP Server.
Because its argon2id instance is thread-safe, we plan to only create a single instance for the lifetime of our app and have each request ...
1
vote
1answer
136 views
Configuring Argon2id for Multiple Threads [duplicate]
We're using argon2-jvm to use Argon2id on our Java TCP Server.
Because its argon2id instance is thread-safe, we plan to only create a single instance for the lifetime of our app and have each request ...
0
votes
0answers
180 views
Safest alternative for hashing credit card numbers to use the hash as fingerprint?
Same question asked here in 2014 but since a lot has changed since then, I would like to get feedback from experts on the latest best practices.
The problem
We need to hash credit card numbers to ...
1
vote
1answer
497 views
Argon2id Configuration
I read an article about how to use Argon2id in C# here.
Below is the code they wrote (slightly edited):
using System;
using System.Diagnostics;
using System.Linq;
using System.Security.Cryptography;
...
2
votes
1answer
415 views
Storing Argon2id parameters in a database?
I've decided to use Argon2id for storing users' passwords in my database.
I have two questions:
Because there are several input parameters (parallelism, iterations etc.) that can influence the ...
1
vote
1answer
78 views
Argon2id key derivation rate calculation question
Just wanted to know if this was an accurate way of determining how long it would take someone with an 8GB GPU to derive 1 million keys using some assumed parameters below:
Time per derivation............
6
votes
1answer
2k views
Which part of this encoded Argon2 hash is the salt?
I was reading the post Is it safe/wise to store a salt in the same field as the hashed password?:
$argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$fPn4sPgkFAuBJo3M3UzcGss3dJysxLJdPdvojRF20ZE=
...
4
votes
2answers
330 views
Is it true that argon2i is “preferred for password hashing and key derivation”?
I was looking at the wiki for the node-argon2 package in npm, when I came around this justification for using argon2i as the default mode:
The variant of the hash function. Argon2 has several ...
37
votes
3answers
9k views
Which is the best password hashing algorithm in .NET Core?
What are the considerations when picking the best password hashing algorithm in .NET Core?
I read that not all hashing algorithms are compliant / unverified, so I am a hesitant on just getting ...
2
votes
1answer
147 views
is it safe to AES encrypt the RSA private key and storing it in the database
i'm building an app that really needs encryption of this type , my question is it safe to store the aes encrypted RSA key in the database ?
here is how i encrypt the key :
i generate a random 256 ...
1
vote
1answer
116 views
Is it safe to use 2 password derivation functions to one password?
The example I'm working on is this:
i store the user password using Argon2 in my database
and then use PBKDF2 to derive an AES key from the user password , and store only the salt used in PBKDF2, i ...
7
votes
1answer
898 views
What are the minimum parameters for Argon2?
Argon2 is the winner of the Password Hashing competition, and currently recommended by OWASP for secure storage of passwords.
One crucial step of Argon2 is determining the parameters used by the ...
-4
votes
1answer
160 views
encrypting file and user have public key to decrypt in barcode [closed]
I want code very secure system and I need some answers and help.
Is this secure if encrypting file and it is possible decrypt with barcode/QRCode where is decryption key to view it.
I've thinking of ...
4
votes
2answers
2k views
Appending a secret (pepper) to Argon2 password hashes
I've read quite a bit of the StackExchange and HackerNews debates on the user of "peppers" in password hash security. There are a number of different implementations of the idea of a pepper, ranging ...
1
vote
2answers
321 views
Is there any advantage to combining a hash algorithm with a key-derivation function?
Let's assume I would like to secure passwords using a modern KDF such as Argon2. The flow of information would look like this: $hash,$salt = argon2id($password, $salt).
Is there any advantage to ...
75
votes
1answer
37k views
In 2018, what is the recommended hash to store passwords: bcrypt, scrypt, Argon2?
There are many questions about picking a hash function, including How to securely hash passwords? or Are there more modern password hashing methods than bcrypt and scrypt?, with very detailed answers, ...
64
votes
7answers
15k views
Is it safe/wise to store a salt in the same field as the hashed password?
In using Argon2 for hashing passwords in my application, I've noticed it generates a string like this (e.g. for password "rabbit"):
$argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$...
3
votes
0answers
98 views
Salt in argon2d as proof-of-work algorithm
I want to use argon2d as a proof-of-work algorithm. But as I know I can't use the algorithm without salt? Should I use a static salt for every task or generate new? Is it possible to increase ...
6
votes
1answer
2k views
Source for up-to-date GPU/ASIC hash performance?
I am looking for CPU, GPU and/or ASIC performance stats on hash performance. Specifically SHA256 and Argon2i. I've googled and only came up with very limited anecdotal evidence. Considering that this ...
