Questions tagged [argon2]
Argon2 is a key derivation function that was selected as the winner of the Password Hashing Competition in July 2015.
24
questions
8
votes
3
answers
3k
views
Argon2 vs SHA-512, what's better in my case?
First I am very bad in cryptographic algorithms.
I found online that Argon2 is more secure than SHA-512, so I used it for password hashing.
There're recommended options for Argon2:
Memory: 4Gb
...
- 183
0
votes
2
answers
755
views
Does sending hashed password over url path parameter secure?
I need to create WebSocket authentication mechanism without using ticketing, so the whole authentication needs to be performed via HTTP (over SSL) GET request which is sent to upgrade connection to ...
- 103
5
votes
2
answers
2k
views
Since GPUs have gigabytes of memory, does Argon2id need to use gigabytes of memory as well in order to effectively thwart GPU cracking?
The common advice of benchmarking a password hashing algorithm and choosing the slowest acceptable cost factor doesn't work for algorithms with more than one parameter: adding a lot of iterations at ...
- 31.8k
1
vote
3
answers
260
views
How does memory-hard hashing passwords protect against brute force attacks?
I have a background in web app development and I'm trying to up my security game but there are some things that I find confusing.
Like how does memory-hard hashed passwords protect against brute force ...
- 13
0
votes
1
answer
223
views
Is using Argon2 with a public random on client side a good idea to protect passwords in transit?
Not sure if things belongs in Crypto SE or here but anyway:
I'm building an app and I'm trying to decide whatever is secure to protect user passwords in transit, in addition to TLS we already have.
In ...
- 103
2
votes
0
answers
205
views
Is it possible to use Argon2id hashes with PAM?
I was wondering if it's possible to implement more secure KDF like bcrypt, scrypt, pbkdf2 and argon2id in PAM authentication.
Ideally I would like to have their hashes instead of SHA-512 ones directly ...
- 23
3
votes
1
answer
299
views
Configuring Argon2id for Multiple Threads
We're using argon2-jvm to use Argon2id on our Java TCP Server.
Because its argon2id instance is thread-safe, we plan to only create a single instance for the lifetime of our app and have each request ...
- 149
0
votes
1
answer
199
views
Configuring Argon2id for Multiple Threads [duplicate]
We're using argon2-jvm to use Argon2id on our Java TCP Server.
Because its argon2id instance is thread-safe, we plan to only create a single instance for the lifetime of our app and have each request ...
- 149
1
vote
1
answer
2k
views
Argon2id Configuration
I read an article about how to use Argon2id in C# here.
Below is the code they wrote (slightly edited):
using System;
using System.Diagnostics;
using System.Linq;
using System.Security.Cryptography;
...
- 149
2
votes
1
answer
1k
views
Storing Argon2id parameters in a database?
I've decided to use Argon2id for storing users' passwords in my database.
I have two questions:
Because there are several input parameters (parallelism, iterations etc.) that can influence the ...
1
vote
1
answer
140
views
Argon2id key derivation rate calculation question
Just wanted to know if this was an accurate way of determining how long it would take someone with an 8GB GPU to derive 1 million keys using some assumed parameters below:
Time per derivation............
- 19
6
votes
1
answer
5k
views
Which part of this encoded Argon2 hash is the salt?
I was reading the post Is it safe/wise to store a salt in the same field as the hashed password?:
$argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$fPn4sPgkFAuBJo3M3UzcGss3dJysxLJdPdvojRF20ZE=
...
- 75
5
votes
2
answers
728
views
Is it true that argon2i is "preferred for password hashing and key derivation"?
I was looking at the wiki for the node-argon2 package in npm, when I came around this justification for using argon2i as the default mode:
The variant of the hash function. Argon2 has several ...
49
votes
3
answers
14k
views
Which is the best password hashing algorithm in .NET Core?
What are the considerations when picking the best password hashing algorithm in .NET Core?
I read that not all hashing algorithms are compliant / unverified, so I am a hesitant on just getting ...
- 613
2
votes
1
answer
247
views
is it safe to AES encrypt the RSA private key and storing it in the database
i'm building an app that really needs encryption of this type , my question is it safe to store the aes encrypted RSA key in the database ?
here is how i encrypt the key :
i generate a random 256 ...
user212160
1
vote
1
answer
163
views
Is it safe to use 2 password derivation functions to one password?
The example I'm working on is this:
i store the user password using Argon2 in my database
and then use PBKDF2 to derive an AES key from the user password , and store only the salt used in PBKDF2, i ...
user212160
11
votes
1
answer
3k
views
What are the minimum parameters for Argon2?
Argon2 is the winner of the Password Hashing competition, and currently recommended by OWASP for secure storage of passwords.
One crucial step of Argon2 is determining the parameters used by the ...
user163495
-4
votes
1
answer
282
views
encrypting file and user have public key to decrypt in barcode [closed]
I want code very secure system and I need some answers and help.
Is this secure if encrypting file and it is possible decrypt with barcode/QRCode where is decryption key to view it.
I've thinking of ...
- 1
4
votes
2
answers
3k
views
Appending a secret (pepper) to Argon2 password hashes
I've read quite a bit of the StackExchange and HackerNews debates on the user of "peppers" in password hash security. There are a number of different implementations of the idea of a pepper, ranging ...
- 402
1
vote
2
answers
517
views
Is there any advantage to combining a hash algorithm with a key-derivation function?
Let's assume I would like to secure passwords using a modern KDF such as Argon2. The flow of information would look like this: $hash,$salt = argon2id($password, $salt).
Is there any advantage to ...
- 11
98
votes
1
answer
49k
views
In 2018, what is the recommended hash to store passwords: bcrypt, scrypt, Argon2?
There are many questions about picking a hash function, including How to securely hash passwords? or Are there more modern password hashing methods than bcrypt and scrypt?, with very detailed answers, ...
- 3,315
66
votes
7
answers
17k
views
Is it safe/wise to store a salt in the same field as the hashed password?
In using Argon2 for hashing passwords in my application, I've noticed it generates a string like this (e.g. for password "rabbit"):
$argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$...
- 771
3
votes
0
answers
151
views
Salt in argon2d as proof-of-work algorithm
I want to use argon2d as a proof-of-work algorithm. But as I know I can't use the algorithm without salt? Should I use a static salt for every task or generate new? Is it possible to increase ...
- 131
6
votes
1
answer
2k
views
Source for up-to-date GPU/ASIC hash performance?
I am looking for CPU, GPU and/or ASIC performance stats on hash performance. Specifically SHA256 and Argon2i. I've googled and only came up with very limited anecdotal evidence. Considering that this ...
- 161