Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [argon2]

Argon2 is a key derivation function that was selected as the winner of the Password Hashing Competition in July 2015.

Filter by
Sorted by
Tagged with
3 votes
1 answer
104 views

Why does OWASP recommend only 1 degree of parallelism for Argon2id

Referencing this document, they give justifications for a number of their recommendations, but not any behind only going with 1 degree of parallelism for using Argon2id. Is there a reason why this is ...
Jesse C. Slicer's user avatar
0 votes
1 answer
112 views

Algorithms when using client side hashing plus server side hashing

So if I got this right from my intense research, the following procedure would be preferrable: Use the PBKDF2 key derivation function to derive a secret key from the users password on the client side. ...
shaniag's user avatar
0 votes
0 answers
167 views

Mixing argon2/HKDF to generate both password hash and encryption key?

I am trying to use a user password in my application to both generate a password hash (for authentication) and to derive a secret key to encrypt user data. Using argon2 is an expensive operation so i ...
codestation's user avatar
1 vote
0 answers
34 views

How should an argon2 hash be stored? [duplicate]

Given the following argon2 hash $argon2id$v=19$m=65536,t=32,p=8$mJmKA5qamzXOPJZYw4wCEUKY$COkMH0RckaZ/3bhYCdCQjLuzoLKxcAmk4TzmHRRgTQ8 How should the hash be stored in a database? From the answers of ...
Zack.B_'s user avatar
  • 11
1 vote
0 answers
29 views

Argon2 is worse than bcrypt at runtimes < 1000 ms? [duplicate]

While Argon2 seems to be recommended for password hashing, based on this twit Argon2 is worse than bcrypt at runtimes < 1000 ms. Based on this answer: You should tweak the parameters to your own ...
ZiiMakc's user avatar
  • 111
0 votes
1 answer
849 views

How long would it take to crack hashed password stored in plain sight?

I want to store a password hash in plain sight. If I am using a dictionary to crack an Argon2 hashed password that I am storing in plain sight, how long would it take (assuming my password is ...
blairmunroakusa's user avatar
0 votes
1 answer
1k views

What argon2id parameters should I adjust [closed]

I am currently running argon2id of hashing function with below parameters on my IphoneXS: Iterations: 8, Memory: 64MB, Parallelism: 8, HashLength: 32, These params allow hashing time to be less than ...
Kim Mỹ's user avatar
  • 145
4 votes
1 answer
1k views

Practicality of outsourcing password hashing using enclaves

I've been pondering some potential cybersecurity applications for enclaves. One of them being the problem of password hashing. Some clients have enclave support, meaning part of their CPU can securely ...
Expectator's user avatar
14 votes
3 answers
13k views

Argon2 vs SHA-512, what's better in my case?

First I am very bad in cryptographic algorithms. I found online that Argon2 is more secure than SHA-512, so I used it for password hashing. There're recommended options for Argon2: Memory: 4Gb ...
Denis Steinman's user avatar
1 vote
2 answers
2k views

Does sending hashed password over url path parameter secure?

I need to create WebSocket authentication mechanism without using ticketing, so the whole authentication needs to be performed via HTTP (over SSL) GET request which is sent to upgrade connection to ...
Kacper G.'s user avatar
  • 113
9 votes
2 answers
5k views

Since GPUs have gigabytes of memory, does Argon2id need to use gigabytes of memory as well in order to effectively thwart GPU cracking?

The common advice of benchmarking a password hashing algorithm and choosing the slowest acceptable cost factor doesn't work for algorithms with more than one parameter: adding a lot of iterations at ...
Luc's user avatar
  • 32.9k
1 vote
3 answers
679 views

How does memory-hard hashing passwords protect against brute force attacks?

I have a background in web app development and I'm trying to up my security game but there are some things that I find confusing. Like how does memory-hard hashed passwords protect against brute force ...
user83191's user avatar
0 votes
1 answer
375 views

Is using Argon2 with a public random on client side a good idea to protect passwords in transit?

Not sure if things belongs in Crypto SE or here but anyway: I'm building an app and I'm trying to decide whatever is secure to protect user passwords in transit, in addition to TLS we already have. In ...
Can Poyrazoğlu's user avatar
2 votes
0 answers
422 views

Is it possible to use Argon2id hashes with PAM?

I was wondering if it's possible to implement more secure KDF like bcrypt, scrypt, pbkdf2 and argon2id in PAM authentication. Ideally I would like to have their hashes instead of SHA-512 ones directly ...
Polizi8's user avatar
  • 163
3 votes
1 answer
619 views

Configuring Argon2id for Multiple Threads

We're using argon2-jvm to use Argon2id on our Java TCP Server. Because its argon2id instance is thread-safe, we plan to only create a single instance for the lifetime of our app and have each request ...
Floating Sunfish's user avatar
0 votes
1 answer
297 views

Configuring Argon2id for Multiple Threads [duplicate]

We're using argon2-jvm to use Argon2id on our Java TCP Server. Because its argon2id instance is thread-safe, we plan to only create a single instance for the lifetime of our app and have each request ...
Floating Sunfish's user avatar
2 votes
1 answer
6k views

Argon2id Configuration

I read an article about how to use Argon2id in C# here. Below is the code they wrote (slightly edited): using System; using System.Diagnostics; using System.Linq; using System.Security.Cryptography; ...
Floating Sunfish's user avatar
2 votes
1 answer
2k views

Storing Argon2id parameters in a database?

I've decided to use Argon2id for storing users' passwords in my database. I have two questions: Because there are several input parameters (parallelism, iterations etc.) that can influence the ...
Filip Procházka's user avatar
1 vote
1 answer
190 views

Argon2id key derivation rate calculation question

Just wanted to know if this was an accurate way of determining how long it would take someone with an 8GB GPU to derive 1 million keys using some assumed parameters below: Time per derivation............
Guy Bartkus's user avatar
6 votes
1 answer
11k views

Which part of this encoded Argon2 hash is the salt?

I was reading the post Is it safe/wise to store a salt in the same field as the hashed password?: $argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$fPn4sPgkFAuBJo3M3UzcGss3dJysxLJdPdvojRF20ZE= ...
Mr.President's user avatar
5 votes
2 answers
1k views

Is it true that argon2i is "preferred for password hashing and key derivation"?

I was looking at the wiki for the node-argon2 package in npm, when I came around this justification for using argon2i as the default mode: The variant of the hash function. Argon2 has several ...
SunshineToast's user avatar
55 votes
3 answers
20k views

Which is the best password hashing algorithm in .NET Core?

What are the considerations when picking the best password hashing algorithm in .NET Core? I read that not all hashing algorithms are compliant / unverified, so I am a hesitant on just getting ...
Water's user avatar
  • 683
2 votes
1 answer
387 views

is it safe to AES encrypt the RSA private key and storing it in the database

i'm building an app that really needs encryption of this type , my question is it safe to store the aes encrypted RSA key in the database ? here is how i encrypt the key : i generate a random 256 ...
user avatar
1 vote
1 answer
191 views

Is it safe to use 2 password derivation functions to one password?

The example I'm working on is this: i store the user password using Argon2 in my database and then use PBKDF2 to derive an AES key from the user password , and store only the salt used in PBKDF2, i ...
user avatar
14 votes
1 answer
7k views

What are the minimum parameters for Argon2?

Argon2 is the winner of the Password Hashing competition, and currently recommended by OWASP for secure storage of passwords. One crucial step of Argon2 is determining the parameters used by the ...
user avatar
-4 votes
1 answer
377 views

encrypting file and user have public key to decrypt in barcode [closed]

I want code very secure system and I need some answers and help. Is this secure if encrypting file and it is possible decrypt with barcode/QRCode where is decryption key to view it. I've thinking of ...
KristenL's user avatar
7 votes
2 answers
6k views

Appending a secret (pepper) to Argon2 password hashes

I've read quite a bit of the StackExchange and HackerNews debates on the user of "peppers" in password hash security. There are a number of different implementations of the idea of a pepper, ranging ...
Prime's user avatar
  • 514
1 vote
2 answers
698 views

Is there any advantage to combining a hash algorithm with a key-derivation function?

Let's assume I would like to secure passwords using a modern KDF such as Argon2. The flow of information would look like this: $hash,$salt = argon2id($password, $salt). Is there any advantage to ...
Joe D.'s user avatar
  • 11
108 votes
1 answer
54k views

In 2018, what is the recommended hash to store passwords: bcrypt, scrypt, Argon2?

There are many questions about picking a hash function, including How to securely hash passwords? or Are there more modern password hashing methods than bcrypt and scrypt?, with very detailed answers, ...
jcaron's user avatar
  • 3,635
65 votes
7 answers
20k views

Is it safe/wise to store a salt in the same field as the hashed password?

In using Argon2 for hashing passwords in my application, I've noticed it generates a string like this (e.g. for password "rabbit"): $argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$...
PenumbraBrah's user avatar
3 votes
0 answers
282 views

Salt in argon2d as proof-of-work algorithm

I want to use argon2d as a proof-of-work algorithm. But as I know I can't use the algorithm without salt? Should I use a static salt for every task or generate new? Is it possible to increase ...
NoTrust's user avatar
  • 131
7 votes
1 answer
3k views

Source for up-to-date GPU/ASIC hash performance?

I am looking for CPU, GPU and/or ASIC performance stats on hash performance. Specifically SHA256 and Argon2i. I've googled and only came up with very limited anecdotal evidence. Considering that this ...
mkoistinen's user avatar