Argon2

Argon2 is a key derivation function that was selected as the winner of the 2015 Password Hashing Competition. It was designed by Alex Biryukov, Daniel Dinu, and Dmitry Khovratovich from the University of Luxembourg. The reference implementation of Argon2 is released under a Creative Commons CC0 license (i.e. public domain) or the Apache License 2.0. The Argon2 function uses a large, fixed-size memory region (often called the 'memory array' in documentation) to make brute-force attacks computationally expensive. The three variants differ in how they access this memory: *Argon2d maximizes resistance to GPU cracking attacks. It accesses the memory array in a password-dependent order, which reduces the possibility of time–memory trade-off (TMTO) attacks, but introduces possible side-channel attacks. *Argon2i is optimized to resist side-channel attacks. It accesses the memory array in a password-independent order. *Argon2id is a hybrid version. It follows the Argon2i approach for the first half pass over memory and the Argon2d approach for subsequent passes. recommends using Argon2id if one does not know the difference between the types or if side-channel attacks are considered to be a viable threat. All three modes allow specification by three parameters that control: *execution time *memory required *degree of parallelism

Argon2 is a key derivation function that was selected as the winner of the 2015 Password Hashing Competition. It was designed by Alex Biryukov, Daniel Dinu, and Dmitry Khovratovich from the University of Luxembourg. The reference implementation of Argon2 is released under a Creative Commons CC0 license (i.e. public domain) or the Apache License 2.0. The Argon2 function uses a large, fixed-size memory region (often called the 'memory array' in documentation) to make brute-force attacks computationally expensive. The three variants differ in how they access this memory: Argon2d maximizes resistance to GPU cracking attacks. It accesses the memory array in a password-dependent order, which reduces the possibility of time–memory trade-off (TMTO) attacks, but introduces possible side-channel attacks. Argon2i is optimized to resist side-channel attacks. It accesses the memory array in a password-independent order. Argon2id is a hybrid version. It follows the Argon2i approach for the first half pass over memory and the Argon2d approach for subsequent passes. recommends using Argon2id if one does not know the difference between the types or if side-channel attacks are considered to be a viable threat. All three modes allow specification by three parameters that control: execution time memory required degree of parallelism The second attack shows that Argon2i can be computed by an algorithm which has complexity O( 7/4 log( )) for all choices of parameters (space cost), (time cost), and thread-count such that = ∗ . The Argon2 authors claim that this attack is not efficient if Argon2i is used with three or more passes. However, Joël Alwen and Jeremiah Blocki improved the attack and showed that in order for the attack to fail, Argon2i v1.3 needs more than 10 passes over memory. To address these concerns, RFC9106 recommends using Argon2id to largely mitigate such attacks. Function Argon2 Inputs: password (P): Bytes (0..2 32 -1) Password (or message) to be hashed salt (S): Bytes (8..2 32 -1) Salt (16 bytes recommended for password hashing) parallelism (p): Number (1..2 24 -1) Degree of parallelism (i.e. number of threads) tagLength (T): Number (4..2 32 -1) Desired number of returned bytes memorySizeKB (m): Number (8p..2 32 -1) Amount of memory (in kibibytes) to use iterations (t): Number (1..2 32 -1) Number of iterations to perform version (v): Number (0x13) The current version is 0x13 (19 decimal) key (K): Bytes (0..2 32 -1) Optional key (Errata: PDF says 0..32 bytes, RFC says 0..2 32 bytes) associatedData (X): Bytes (0..2 32 -1) Optional arbitrary extra data hashType (y): Number (0=Argon2d, 1=Argon2i, 2=Argon2id) Output: tag: Bytes (tagLength) The resulting generated bytes, tagLength bytes long Generate initial 64-byte block H 0 . All the input parameters are concatenated and input as a source of additional entropy. Errata: RFC says H 0 is 64-bits; PDF says H 0 is 64-bytes. Errata: RFC says the Hash is H^, the PDF says it's ℋ (but doesn't document what ℋ is). It's actually Blake2b. Variable length items are prepended with their length as 32-bit little-endian integers. buffer ← parallelism ∥ tagLength ∥ memorySizeKB ∥ iterations ∥ version ∥ hashType ∥ Length(password) ∥ Password ∥ Length(salt) ∥ salt ∥ Length(key) ∥ key ∥ Length(associatedData) ∥ associatedData H 0 ← Blake2b(buffer, 64) //default hash size of Blake2b is 64-bytes Calculate number of 1 KB blocks by rounding down memorySizeKB to the nearest multiple of 4*parallelism kibibytes blockCount ← Floor(memorySizeKB, 4*parallelism) Allocate two-dimensional array of 1 KiB blocks (parallelism rows x columnCount columns) columnCount ← blockCount / parallelism; //In the RFC, columnCount is referred to as q Compute the first and second block (i.e. column zero and one) of each lane (i.e. row) for i ← 0 to parallelism-1 do for each row B i [0] ← Hash(H 0 ∥ 0 ∥ i, 1024) //Generate a 1024-byte digest B i [1] ← Hash(H 0 ∥ 1 ∥ i, 1024) //Generate a 1024-byte digest Compute remaining columns of each lane for i ← 0 to parallelism-1 do //for each row for j ← 2 to columnCount-1 do //for each subsequent column //i' and j' indexes depend if it's Argon2i, Argon2d, or Argon2id (See section 3.4) i′, j′ ← GetBlockIndexes(i, j) //the GetBlockIndexes function is not defined B i [j] = G(B i [j-1], B i′ [j′]) //the G hash function is not defined Further passes when iterations > 1 for nIteration ← 2 to iterations do for i ← 0 to parallelism-1 do for each row for j ← 0 to columnCount-1 do //for each subsequent column //i' and j' indexes depend if it's Argon2i, Argon2d, or Argon2id (See section 3.4) i′, j′ ← GetBlockIndexes(i, j) if j == 0 then B i [0] = B i [0] xor G(B i [columnCount-1], B i′ [j′]) else B i [j] = B i [j] xor G(B i [j-1], B i′ [j′]) Compute final block C as the XOR of the last column of each row C ← B 0 [columnCount-1] for i ← 1 to parallelism-1 do C ← C xor B i [columnCount-1] Compute output tag return Hash(C, tagLength)

Text derived from https://en.wikipedia.org/w/index.php?oldid=1338928621 under CC BY-SA 4.0; modifications have been made.