4 ms·
Password with Argon2 Algorithm, the Winner of the Password Hashing Competition
- gnabgib 5y agoThe competition was in 2015[0].. perhaps the title should include 2015 (when the competition closed and Argon2 won) or should be adjusted to "Argon2 Hash Generator & Verifier" (the name of the linked page - unrelated to the competition) [0]: https://www.password-hashing.net/ https://www.password-hashing.net/
- willis936 5y agoIs there any reason not to use Argon2i or Argon2id over Argon2? Non-public side-channel exploits seem inevitable.
- CyberRage 5y ago"Non-public side-channel exploits seem inevitable" Have to disagree here buddy Argon2d has better resistance to TMTO and hardware accelerated cracking due to the data-depending memory access. Side-channels attacks are not practical in many scenarios and won't be the easiest way to extract secrets in them. Local hashing of any sort without external interaction is better with argon2d for better cracking resistance. Those are great on paper, but in practice you either have a much easier way to extract those secrets with the amount of access you need for a side channel attack or they are too unreliable to truly leverage. Many solutions use argon2d with great success.
- pabs3 5y agoI hear yescrypt is the successor of argon2: https://www.openwall.com/yescrypt/ https://www.openwall.com/yescrypt/
- bawolff 5y agoWait, why would it be a successor if they were both in the phc and yescrypt didn't win.
- imwillofficial 5y agoI’ve never heard of the PHC, is it a Big deal?
- bawolff 5y agoWell it is the article we are in theory discussing.
- imwillofficial 5y agoRight, so is this some random running their own tests or is this the gold standard of testing these days. I’ve been out of the crypto game for a decade.
- jimmar 5y agoI don't distrust https://www.password-hashing.net/ https://www.password-hashing.net/, but I have a hard time gauging its credibility. Why should I trust the results of its password hashing competition?
- bawolff 5y agoYou shouldn't. You should trust the subsequent research (or lack thereof of results) and compare its record to other similar algorithms.
- CyberRage 5y agoWhy should you trust AES? an algorithm chosen by a competition?
- bawolff 5y agoTbf, NIST has a much bigger reputation, and the aes competition was a much larger affair attracting a large swath of experts.
- CyberRage 5y agoPHC had some of the biggest names in the crypto field, had NIST representation and multi-stage evaluations with top notch testing. PHC was far more mature in many ways over AES.
- wolverine876 5y agoWhy are people giving their IPs and other identifying info to a stranger (by loading a website), then giving them their passwords? What reason do I have for generating a hash of my password in this context?
- shakezula 5y agoI don’t think it’s meant to be used as a legitimate password generator. It’s meant to showcase the knobs you can tweak on the algorithm. It’s a marketing tool.