3 ms·

> There are two main versions of Argon2, Argon2i and Argon2d. Argon2i is the safest against side-channel attacks, while Argon2d provides the highest resistance

> There are two main versions of Argon2, Argon2i and Argon2d. Argon2i is the safest against side-channel attacks, while Argon2d provides the highest resistance against GPU cracking attacks. Does this mean that one has to choose between protection against side-channel attacks and protection against GPU cracking? While not the "safest", how safe is Argon2d against side-channel attacks, and vice-versa? Any advice on making this choice? (It's late here so I haven't read the paper yet. Apologies if this is all covered in there.)

jph 11y ago
Quick answer: use Argon2i, unless you have very special needs. "Argon2i uses data-independent memory access, which is preferred for password hashing and password-based key derivation. Argon2i is slower as it makes more passes over the memory to protect from tradeoff attacks." "Argon2d is faster and uses data-depending memory access, which makes it suitable for cryptocurrencies and applications with no threats from side-channel timing attacks." The IETF draft is here: https://tools.ietf.org/html/draft-josefsson-argon2-00 https://tools.ietf.org/html/draft-josefsson-argon2-00
nightcracker 11y ago
> Does this mean that one has to choose between protection against side-channel attacks and protection against GPU cracking? Yes. Argon2i is still resistant against GPU cracking, however with advanced techniques some speedup might be acquired. Argon2d is really GPU unfriendly. The paper explains: > Should the memory addressing (indexing functions) be input-independent or input-dependent, or hybrid? The first type of schemes, where the memory read location are known in advance, is immediately vulnerable to time-space tradeoff attacks, since an adversary can precompute the missing block by the time it is needed [5]. In turn, the input-dependent schemes are vulnerable to side-channel attacks [14], as the timing information allows for much faster password search. And the recommendation from the paper: > Argon2 has two variants: Argon2d and Argon2i. Argon2d is faster and uses data-depending memory access, which makes it suitable for cryptocurrencies and applications with no threats from side-channel timing attacks. Argon2i uses data-independent memory access, which is preferred for password hashing and password-based key derivation.
fryguy 11y ago
Basically, use Argon2d for proof-of-work, and Argon2i for everything else.
- tromp 11y ago
  A memory intensive proof-of-work should be much faster to verify than to attempt a proof.
khovratovich 11y ago
It is always safe to use Argon2i with smallest possible t=1 unless ASIC-equipped attackers is a viable threat to you.

jph 11y ago

Quick answer: use Argon2i, unless you have very special needs. "Argon2i uses data-independent memory access, which is preferred for password hashing and password-based key derivation. Argon2i is slower as it makes more passes over the memory to protect from tradeoff attacks." "Argon2d is faster and uses data-depending memory access, which makes it suitable for cryptocurrencies and applications with no threats from side-channel timing attacks." The IETF draft is here: https://tools.ietf.org/html/draft-josefsson-argon2-00 https://tools.ietf.org/html/draft-josefsson-argon2-00

nightcracker 11y ago

> Does this mean that one has to choose between protection against side-channel attacks and protection against GPU cracking? Yes. Argon2i is still resistant against GPU cracking, however with advanced techniques some speedup might be acquired. Argon2d is really GPU unfriendly. The paper explains: > Should the memory addressing (indexing functions) be input-independent or input-dependent, or hybrid? The first type of schemes, where the memory read location are known in advance, is immediately vulnerable to time-space tradeoff attacks, since an adversary can precompute the missing block by the time it is needed [5]. In turn, the input-dependent schemes are vulnerable to side-channel attacks [14], as the timing information allows for much faster password search. And the recommendation from the paper: > Argon2 has two variants: Argon2d and Argon2i. Argon2d is faster and uses data-depending memory access, which makes it suitable for cryptocurrencies and applications with no threats from side-channel timing attacks. Argon2i uses data-independent memory access, which is preferred for password hashing and password-based key derivation.

fryguy 11y ago

Basically, use Argon2d for proof-of-work, and Argon2i for everything else.

tromp 11y ago
A memory intensive proof-of-work should be much faster to verify than to attempt a proof.

khovratovich 11y ago

It is always safe to use Argon2i with smallest possible t=1 unless ASIC-equipped attackers is a viable threat to you.