Questions tagged [argon2]
Argon2 is a key derivation function that was selected as the winner of the Password Hashing Competition in July 2015.
30
questions
0
votes
0
answers
48
views
Mixing argon2/HKDF to generate both password hash and encryption key?
I am trying to use a user password in my application to both generate a password hash (for authentication) and to derive a secret key to encrypt user data.
Using argon2 is an expensive operation so i ...
- 101
1
vote
0
answers
34
views
How should an argon2 hash be stored? [duplicate]
Given the following argon2 hash
$argon2id$v=19$m=65536,t=32,p=8$mJmKA5qamzXOPJZYw4wCEUKY$COkMH0RckaZ/3bhYCdCQjLuzoLKxcAmk4TzmHRRgTQ8
How should the hash be stored in a database? From the answers of ...
- 11
1
vote
0
answers
28
views
Argon2 is worse than bcrypt at runtimes < 1000 ms? [duplicate]
While Argon2 seems to be recommended for password hashing, based on this twit Argon2 is worse than bcrypt at runtimes < 1000 ms.
Based on this answer:
You should tweak the parameters to your own ...
- 111
0
votes
1
answer
417
views
How long would it take to crack hashed password stored in plain sight?
I want to store a password hash in plain sight. If I am using a dictionary to crack an Argon2 hashed password that I am storing in plain sight, how long would it take (assuming my password is ...
0
votes
1
answer
667
views
What argon2id parameters should I adjust [closed]
I am currently running argon2id of hashing function with below parameters on my IphoneXS:
Iterations: 8, Memory: 64MB, Parallelism: 8, HashLength: 32,
These params allow hashing time to be less than ...
- 145
4
votes
1
answer
1k
views
Practicality of outsourcing password hashing using enclaves
I've been pondering some potential cybersecurity applications for enclaves. One of them being the problem of password hashing.
Some clients have enclave support, meaning part of their CPU can securely ...
- 280
13
votes
3
answers
10k
views
Argon2 vs SHA-512, what's better in my case?
First I am very bad in cryptographic algorithms.
I found online that Argon2 is more secure than SHA-512, so I used it for password hashing.
There're recommended options for Argon2:
Memory: 4Gb
...
- 233
0
votes
2
answers
2k
views
Does sending hashed password over url path parameter secure?
I need to create WebSocket authentication mechanism without using ticketing, so the whole authentication needs to be performed via HTTP (over SSL) GET request which is sent to upgrade connection to ...
- 103
9
votes
2
answers
4k
views
Since GPUs have gigabytes of memory, does Argon2id need to use gigabytes of memory as well in order to effectively thwart GPU cracking?
The common advice of benchmarking a password hashing algorithm and choosing the slowest acceptable cost factor doesn't work for algorithms with more than one parameter: adding a lot of iterations at ...
- 32.7k
1
vote
3
answers
531
views
How does memory-hard hashing passwords protect against brute force attacks?
I have a background in web app development and I'm trying to up my security game but there are some things that I find confusing.
Like how does memory-hard hashed passwords protect against brute force ...
- 13
0
votes
1
answer
331
views
Is using Argon2 with a public random on client side a good idea to protect passwords in transit?
Not sure if things belongs in Crypto SE or here but anyway:
I'm building an app and I'm trying to decide whatever is secure to protect user passwords in transit, in addition to TLS we already have.
In ...
- 103
2
votes
0
answers
354
views
Is it possible to use Argon2id hashes with PAM?
I was wondering if it's possible to implement more secure KDF like bcrypt, scrypt, pbkdf2 and argon2id in PAM authentication.
Ideally I would like to have their hashes instead of SHA-512 ones directly ...
- 63
3
votes
1
answer
523
views
Configuring Argon2id for Multiple Threads
We're using argon2-jvm to use Argon2id on our Java TCP Server.
Because its argon2id instance is thread-safe, we plan to only create a single instance for the lifetime of our app and have each request ...
- 159
0
votes
1
answer
261
views
Configuring Argon2id for Multiple Threads [duplicate]
We're using argon2-jvm to use Argon2id on our Java TCP Server.
Because its argon2id instance is thread-safe, we plan to only create a single instance for the lifetime of our app and have each request ...
- 159
2
votes
1
answer
5k
views
Argon2id Configuration
I read an article about how to use Argon2id in C# here.
Below is the code they wrote (slightly edited):
using System;
using System.Diagnostics;
using System.Linq;
using System.Security.Cryptography;
...
- 159
2
votes
1
answer
2k
views
Storing Argon2id parameters in a database?
I've decided to use Argon2id for storing users' passwords in my database.
I have two questions:
Because there are several input parameters (parallelism, iterations etc.) that can influence the ...
1
vote
1
answer
163
views
Argon2id key derivation rate calculation question
Just wanted to know if this was an accurate way of determining how long it would take someone with an 8GB GPU to derive 1 million keys using some assumed parameters below:
Time per derivation............
- 19
6
votes
1
answer
10k
views
Which part of this encoded Argon2 hash is the salt?
I was reading the post Is it safe/wise to store a salt in the same field as the hashed password?:
$argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$fPn4sPgkFAuBJo3M3UzcGss3dJysxLJdPdvojRF20ZE=
...
- 75
5
votes
2
answers
1k
views
Is it true that argon2i is "preferred for password hashing and key derivation"?
I was looking at the wiki for the node-argon2 package in npm, when I came around this justification for using argon2i as the default mode:
The variant of the hash function. Argon2 has several ...
53
votes
3
answers
18k
views
Which is the best password hashing algorithm in .NET Core?
What are the considerations when picking the best password hashing algorithm in .NET Core?
I read that not all hashing algorithms are compliant / unverified, so I am a hesitant on just getting ...
- 663
2
votes
1
answer
344
views
is it safe to AES encrypt the RSA private key and storing it in the database
i'm building an app that really needs encryption of this type , my question is it safe to store the aes encrypted RSA key in the database ?
here is how i encrypt the key :
i generate a random 256 ...
user212160
1
vote
1
answer
169
views
Is it safe to use 2 password derivation functions to one password?
The example I'm working on is this:
i store the user password using Argon2 in my database
and then use PBKDF2 to derive an AES key from the user password , and store only the salt used in PBKDF2, i ...
user212160
14
votes
1
answer
6k
views
What are the minimum parameters for Argon2?
Argon2 is the winner of the Password Hashing competition, and currently recommended by OWASP for secure storage of passwords.
One crucial step of Argon2 is determining the parameters used by the ...
user163495
-4
votes
1
answer
355
views
encrypting file and user have public key to decrypt in barcode [closed]
I want code very secure system and I need some answers and help.
Is this secure if encrypting file and it is possible decrypt with barcode/QRCode where is decryption key to view it.
I've thinking of ...
- 1
6
votes
2
answers
5k
views
Appending a secret (pepper) to Argon2 password hashes
I've read quite a bit of the StackExchange and HackerNews debates on the user of "peppers" in password hash security. There are a number of different implementations of the idea of a pepper, ranging ...
- 494
1
vote
2
answers
640
views
Is there any advantage to combining a hash algorithm with a key-derivation function?
Let's assume I would like to secure passwords using a modern KDF such as Argon2. The flow of information would look like this: $hash,$salt = argon2id($password, $salt).
Is there any advantage to ...
- 11
107
votes
1
answer
54k
views
In 2018, what is the recommended hash to store passwords: bcrypt, scrypt, Argon2?
There are many questions about picking a hash function, including How to securely hash passwords? or Are there more modern password hashing methods than bcrypt and scrypt?, with very detailed answers, ...
- 3,585
66
votes
7
answers
19k
views
Is it safe/wise to store a salt in the same field as the hashed password?
In using Argon2 for hashing passwords in my application, I've noticed it generates a string like this (e.g. for password "rabbit"):
$argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$...
- 771
3
votes
0
answers
238
views
Salt in argon2d as proof-of-work algorithm
I want to use argon2d as a proof-of-work algorithm. But as I know I can't use the algorithm without salt? Should I use a static salt for every task or generate new? Is it possible to increase ...
- 131
6
votes
1
answer
3k
views
Source for up-to-date GPU/ASIC hash performance?
I am looking for CPU, GPU and/or ASIC performance stats on hash performance. Specifically SHA256 and Argon2i. I've googled and only came up with very limited anecdotal evidence. Considering that this ...
- 161