3 ms·

In general it is is not true that Argon2 should be recommended over bcrypt. Even even some of the people on the experts panel for the PHC (where Argon2 won) wo

In general it is is not true that Argon2 should be recommended over bcrypt. Even even some of the people on the experts panel for the PHC (where Argon2 won) won’t recommend Argon2 over Bcrypt: https://twitter.com/TerahashCorp/status/1155129705034653698 https://twitter.com/TerahashCorp/status/1155129705034653698 Looks like for the typical case (~200ms calculating the hash) bcrypt beats argon2. I guess that’s what I understand from those discussions, I’m not an expert by any means. It is related with cache hardness: https://twitter.com/Sc00bzT/status/1149963675069026304 https://twitter.com/Sc00bzT/status/1149963675069026304

IAmLiterallyAB 6y ago
Wow. Never heard that before. Would love a proper article on that. I wonder how scrypt holds up
- kevinarpe 6y ago
  I am not a security expert, but this looks pretty useful: https://security.stackexchange.com/questions/193351/in-2018-what-is-the-recommended-hash-to-store-passwords-bcrypt-scrypt-argon2 https://security.stackexchange.com/questions/193351/in-2018-... And that Twitter link (https://twitter.com/TerahashCorp/status/1155129705034653698 https://twitter.com/TerahashCorp/status/1155129705034653698) leads here: https://www.password-hashing.net/ https://www.password-hashing.net/ ... but, on that website, I could not find an explanation about why to use argon2 over bcrypt.
Straw 6y ago
Interesting, I hadn't seen this before. I find it hard to believe, as Argon2 does psuedorandom access over a large array. As soon as this array gets larger than the local GPU cache (much smaller than CPU cache), we should get pretty good protection. What have I missed? In particular, in terms of ASIC attacks, bcrypt and other non-memory-hard KDFs have extremely efficient implementations. Silicon is cheap, computation is cheap, memory access is extremely expensive- both in terms of time and power usage.

IAmLiterallyAB 6y ago

Wow. Never heard that before. Would love a proper article on that. I wonder how scrypt holds up

kevinarpe 6y ago
I am not a security expert, but this looks pretty useful: https://security.stackexchange.com/questions/193351/in-2018-what-is-the-recommended-hash-to-store-passwords-bcrypt-scrypt-argon2 https://security.stackexchange.com/questions/193351/in-2018-... And that Twitter link (https://twitter.com/TerahashCorp/status/1155129705034653698 https://twitter.com/TerahashCorp/status/1155129705034653698) leads here: https://www.password-hashing.net/ https://www.password-hashing.net/ ... but, on that website, I could not find an explanation about why to use argon2 over bcrypt.

Straw 6y ago

Interesting, I hadn't seen this before. I find it hard to believe, as Argon2 does psuedorandom access over a large array. As soon as this array gets larger than the local GPU cache (much smaller than CPU cache), we should get pretty good protection. What have I missed? In particular, in terms of ASIC attacks, bcrypt and other non-memory-hard KDFs have extremely efficient implementations. Silicon is cheap, computation is cheap, memory access is extremely expensive- both in terms of time and power usage.