4 ms·

Is there any reason to prefer Argon2 over scrypt? The article dismisses it as not popular, but doesn't say why we should invest in making Argon2 popular over sc

• creshal 11y ago
  The scrypt-derived yescrypt participated alongside argon2 in the PHC[1], and argon2 was chosen in favour of it – mainly because scrypt is a bloody complex mess to implement –, but yescrypt is still recommended if you need backwards compatibility with it. [1](https://password-hashing.net/ https://password-hashing.net/)
• jbandela1 11y ago
  One of the nice things that Argon2 has is server relief. Instead of doing the entirety of the computation on the server you can have the client do the most demanding parts and send those intermediate values to the server which can then finish the much easier computatation.
  • fryguy 11y ago
    Really, any password hash `PH(m,p)` can have server-relief by adding a regular cryptographic hash function `H` and making H∘PH your hash function. By this, you store `p||H(PH(m,p))` in the database, and have the client compute `PH(m,p)` and send it to the server rather than sending the password `p`. You still have to send the salting information to the client though or use . I don't see the server relief in Argon2's latest specification document though.
    • creshal 11y ago
      I.E., cram-md5 and related password schemes. It's a shame it fell out of favour, I'd sure prefer something like this over sending plain text passwords via TLS…
      • fryguy 11y ago
        Ideally we eventually get rid of passwords and use secret/private keypairs in the browser, or have some browser-based SRP.