3 ms·

So there's a bunch of people here saying Argon2, whereas I thought one of the current best recommendations was scrypt. Can someone explain the trade-off between

• fractionalhare 6y ago
  Both are pretty much fine. Just choose one. With certainty approaching 1, you will not run into a situation where this is a meaningful decision for you. There are a lot of security decisions that really require more thought, this is not one of them. bcrypt, scrypt, Argon2: it doesn't practically matter. Actual cryptographers don't stop recommending safe and well-tested algorithms just because newer ones have been published. There has been no cryptanalytic break in bcrypt or scrypt. The benefits of Argon2 are largely academic for common workloads.
• staticassertion 6y ago
  Going off of memory, happy to be corrected. So something like pbkdf2 is intended to be "CPU hard" ie: it bottlenecks you on CPU. Then people started using GPUs for pbkdf2. So we got bcrypt, which is CPU hard and uses enough memory that a GPU stops being particularly practical. And then people build ASICs to bruteforce bcrypt faster. So we got scrypt and argon2, which are memory hard. But the thing is that even PBKDF2 is pretty good. You can always just bump up the iteration count for PBKDF2 to increase security. I use a combination of PBKDF2 and bcrypt myself (pbkdf2 on the frontend, bcrypt on the backend).