Argon2

<h2 id="cryptanalysis">Cryptanalysis</h2>
While there is no public <a href="/facts/Cryptanalysis/7CPEQlJI">cryptanalysis</a> applicable to Argon2d, there are two published attacks on the Argon2i function. The first attack is applicable only to the old version of Argon2i, while the second has been extended to the latest version (1.3).<a class="footnote-ref" id="fnref:5" href="#fn:5">5</a>
The first attack shows that it is possible to compute a single-pass Argon2i function using between a quarter and a fifth of the desired space with no time penalty, and compute a multiple-pass Argon2i using only N/e (≈ N/2.72) space with no time penalty.<a class="footnote-ref" id="fnref:6" href="#fn:6">6</a> According to the Argon2 authors, this attack vector was fixed in version 1.3.<a class="footnote-ref" id="fnref:7" href="#fn:7">7</a>
The second attack shows that Argon2i can be computed by an algorithm which has complexity O(n7/4 log(n)) for all choices of parameters σ (space cost), τ (time cost), and thread-count such that n=σ∗τ.<a class="footnote-ref" id="fnref:8" href="#fn:8">8</a> The Argon2 authors claim that this attack is not efficient if Argon2i is used with three or more passes.<a class="footnote-ref" id="fnref:9" href="#fn:9">9</a> However, Joël Alwen and Jeremiah Blocki improved the attack and showed that in order for the attack to fail, Argon2i v1.3 needs more than 10 passes over memory.<a class="footnote-ref" id="fnref:10" href="#fn:10">10</a>
To address these concerns, RFC9106 recommends using Argon2id to largely mitigate such attacks. <a class="footnote-ref" id="fnref:11" href="#fn:11">11</a>

<h2 id="algorithm">Algorithm</h2>
Source:<a class="footnote-ref" id="fnref:12" href="#fn:12">12</a>

Function Argon2
 Inputs:
 password (P): Bytes (0..232-1) Password (or message) to be hashed
 salt (S): Bytes (8..232-1) Salt (16 bytes recommended for password hashing)
 parallelism (p): Number (1..224-1) Degree of parallelism (i.e. number of threads)
 tagLength (T): Number (4..232-1) Desired number of returned bytes
 memorySizeKB (m): Number (8p..232-1) Amount of memory (in <a href="/facts/Kibibyte/BNHUp9Qq">kibibytes</a>) to use
 iterations (t): Number (1..232-1) Number of iterations to perform
 version (v): Number (0x13) The current version is 0x13 (19 decimal)
 key (K): Bytes (0..232-1) Optional key (Errata: PDF says 0..32 bytes, RFC says 0..232 bytes)
 associatedData (X): Bytes (0..232-1) Optional arbitrary extra data
 hashType (y): Number (0=Argon2d, 1=Argon2i, 2=Argon2id)
 Output:
 tag: Bytes (tagLength) The resulting generated bytes, tagLength bytes long

Generate initial 64-byte block H0.
 All the input parameters are concatenated and input as a source of additional entropy.
 Errata: RFC says H0 is 64-bits; PDF says H0 is 64-bytes.
 Errata: RFC says the Hash is H^, the PDF says it's ℋ (but doesn't document what ℋ is). It's actually Blake2b.
 Variable length items are prepended with their length as 32-bit little-endian integers.
 buffer ← parallelism ∥ tagLength ∥ memorySizeKB ∥ iterations ∥ version ∥ hashType
 ∥ Length(password) ∥ Password
 ∥ Length(salt) ∥ salt
 ∥ Length(key) ∥ key
 ∥ Length(associatedData) ∥ associatedData
 H0 ← Blake2b(buffer, 64) //default hash size of Blake2b is 64-bytes

Calculate number of 1 KB blocks by rounding down memorySizeKB to the nearest multiple of 4*parallelism <a href="/facts/Kibibyte/BNHUp9Qq">kibibytes</a>
 blockCount ← Floor(memorySizeKB, 4*parallelism)

Allocate two-dimensional array of 1 KiB blocks (parallelism rows x columnCount columns)
   columnCount ← blockCount / parallelism;   //In the RFC, columnCount is referred to as q

Compute the first and second block (i.e. column zero and one ) of each lane (i.e. row)
 for i ← 0 to parallelism-1 do for each row
 Bi[0] ← Hash(H0 ∥ 0 ∥ i, 1024) //Generate a 1024-byte digest
 Bi[1] ← Hash(H0 ∥ 1 ∥ i, 1024) //Generate a 1024-byte digest

Compute remaining columns of each lane
   for i ← 0 to parallelism-1 do //for each row
      for j ← 2 to columnCount-1 do //for each subsequent column
         //i' and j' indexes depend if it's Argon2i, Argon2d, or Argon2id (See section 3.4)
         i′, j′ ← GetBlockIndexes(i, j)  //the GetBlockIndexes function is not defined
         Bi[j] = G(Bi[j-1], Bi′[j′]) //the G hash function is not defined

Further passes when iterations > 1
   for nIteration ← 2 to iterations do
      for i ← 0 to parallelism-1 do for each row
        for j ← 0 to columnCount-1 do //for each subsequent column
           //i' and j' indexes depend if it's Argon2i, Argon2d, or Argon2id (See section 3.4)
           i′, j′ ← GetBlockIndexes(i, j)
           if j == 0 then 
             Bi[0] = Bi[0] xor G(Bi[columnCount-1], Bi′[j′])
           else
             Bi[j] = Bi[j] xor G(Bi[j-1], Bi′[j′])

Compute final block C as the XOR of the last column of each row
   C ← B0[columnCount-1]
   for i ← 1 to parallelism-1 do
      C ← C xor Bi[columnCount-1]

Compute output tag
   return Hash(C, tagLength)

<h3>Variable-length hash function</h3>
Argon2 makes use of a hash function capable of producing digests up to 232 bytes long. This hash function is internally built upon <a href="/facts/Blake2/3QuBJ24f">Blake2</a>.

 Function Hash(message, digestSize)
 Inputs:
 message: Bytes (0..232-1) Message to be hashed
 digestSize: Integer (1..232) Desired number of bytes to be returned
 Output:
 digest: Bytes (digestSize) The resulting generated bytes, digestSize bytes long
 
 Hash is a variable-length hash function, built using Blake2b, capable of generating
 digests up to 232 bytes.
 
 If the requested digestSize is 64-bytes or lower, then we use Blake2b directly
 if (digestSize <= 64) then
 return Blake2b(digestSize ∥ message, digestSize) // concatenate 32-bit little endian digestSize with the message bytes
 
 For desired hashes over 64-bytes (e.g. 1024 bytes for Argon2 blocks),
 we use Blake2b to generate twice the number of needed 64-byte blocks,
 and then only use 32-bytes from each block
 
 Calculate the number of whole blocks (knowing we're only going to use 32-bytes from each)
 r ← Ceil(digestSize/32)-2;
 
 Generate r whole blocks.
 Initial block is generated from message
 V1 ← Blake2b(digestSize ∥ message, 64);
 Subsequent blocks are generated from previous blocks
 for i ← 2 to r do
 Vi ← Blake2b(Vi-1, 64)
 Generate the final (possibly partial) block
 partialBytesNeeded ← digestSize – 32*r;
 Vr+1 ← Blake2b(Vr, partialBytesNeeded)
 
 Concatenate the first 32-bytes of each block Vi
 (except the possibly partial last block, which we take the whole thing)
 Let Ai represent the lower 32-bytes of block Vi
 return A1 ∥ A2 ∥ ... ∥ Ar ∥ Vr+1
<h2 id="recommended-minimum-parameters">Recommended minimum parameters</h2>
As of May 2023, <a href="/facts/OWASP/t30EKe8Q">OWASP</a>'s Password Storage Cheat Sheet recommends that people "use Argon2id with a minimum configuration of 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism."<a class="footnote-ref" id="fnref:13" href="#fn:13">13</a>
OWASP recommends that Argon2id should be preferred over Argon2d and Argon2i because it provides a balanced resistance to both GPU-based attacks and side-channel attacks.<a class="footnote-ref" id="fnref:14" href="#fn:14">14</a>
OWASP further notes that the following Argon2id options provide equivalent cryptographic strength and simply trade off memory usage for compute workload:<a class="footnote-ref" id="fnref:15" href="#fn:15">15</a>

<ul><li>Memory: 46 MiB, Iterations: 1, Parallelism: 1</li>
<li>Memory: 19 MiB, Iterations: 2, Parallelism: 1</li>
<li>Memory: 12 MiB, Iterations: 3, Parallelism: 1</li>
<li>Memory: 9 MiB, Iterations: 4, Parallelism: 1</li>
<li>Memory: 7 MiB, Iterations: 5, Parallelism: 1</li></ul>

<h2 id="external-links">External links</h2>
<ul><li><a href="https://github.com/p-h-c/phc-winner-argon2">Argon2 source code repository on Github</a></li>
<li><a href="https://www.cryptolux.org/images/0/0d/Argon2.pdf">Argon2 specification</a></li>
<li><a href="https://password-hashing.net/">Password Hashing Competition</a></li>
<li><a href="https://www.cryptolux.org/index.php/Argon2">Uni.Lu Argon2 Page</a></li>
<li><a href="https://eprint.iacr.org/2016/027.pdf">Balloon Hashing: A Memory-Hard Function Providing Provable Protection Against Sequential Attacks</a></li>
<li>RFC <a href="https://www.rfc-editor.org/rfc/rfc9106">9106</a> Argon2 Memory-Hard Function for Password Hashing and Proof-of-Work Applications</li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1">"Password Hashing Competition" <a href="https://password-hashing.net/" target="_blank">https://password-hashing.net/</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></li>
<li id="fn:2">Jos Wetzels (2016-02-08). "Open Sesame: The Password Hashing Competition and Argon2". arXiv:1602.03097 [cs.CR]. <a href="/wiki/ArXiv_(identifier)" target="_blank">/wiki/ArXiv_(identifier)</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></li>
<li id="fn:3">Argon2: the memory-hard function for password hashing and other applications, Alex Biryukov, et al, October 1, 2015 <a href="https://password-hashing.net/argon2-specs.pdf" target="_blank">https://password-hashing.net/argon2-specs.pdf</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></li>
<li id="fn:4">Biryukov, Alex; Dinu, Daniel; Khovratovich, Dmitry; Josefsson, Simon (September 2021). "Argon2 Memory-Hard Function for Password Hashing and Proof-of-Work Applications". Retrieved September 9, 2021. <a href="https://www.rfc-editor.org/rfc/rfc9106.html" target="_blank">https://www.rfc-editor.org/rfc/rfc9106.html</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></li>
<li id="fn:5">Joël Alwen; Jeremiah Blocki (2016-08-05). Towards Practical Attacks on Argon2i and Balloon Hashing (PDF) (Report). <a href="https://eprint.iacr.org/2016/759.pdf" target="_blank">https://eprint.iacr.org/2016/759.pdf</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></li>
<li id="fn:6">Henry; Corrigan-Gibbs; Dan Boneh; Stuart Schechter (2016-01-14). Balloon Hashing: Provably Space-Hard Hash Functions with Data-Independent Access Patterns (PDF) (Report). <a href="https://eprint.iacr.org/2016/027.pdf" target="_blank">https://eprint.iacr.org/2016/027.pdf</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></li>
<li id="fn:7">"[Cfrg] Argon2 v.1.3". www.ietf.org. Retrieved 2016-10-30. <a href="https://www.ietf.org/mail-archive/web/cfrg/current/msg07948.html" target="_blank">https://www.ietf.org/mail-archive/web/cfrg/current/msg07948.html</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></li>
<li id="fn:8">Joël Alwen; Jeremiah Blocki (2016-02-19). Efficiently Computing Data-Independent Memory-Hard Functions (PDF) (Report). <a href="https://eprint.iacr.org/2016/115.pdf" target="_blank">https://eprint.iacr.org/2016/115.pdf</a> <a href="#fnref:8" class="footnote-back-ref">↩</a></li>
<li id="fn:9">"[Cfrg] Argon2 v.1.3". www.ietf.org. Retrieved 2016-10-30. <a href="https://www.ietf.org/mail-archive/web/cfrg/current/msg07948.html" target="_blank">https://www.ietf.org/mail-archive/web/cfrg/current/msg07948.html</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></li>
<li id="fn:10">Joël Alwen; Jeremiah Blocki (2016-08-05). Towards Practical Attacks on Argon2i and Balloon Hashing (PDF) (Report). <a href="https://eprint.iacr.org/2016/759.pdf" target="_blank">https://eprint.iacr.org/2016/759.pdf</a> <a href="#fnref:10" class="footnote-back-ref">↩</a></li>
<li id="fn:11">"Recommendations". Argon2 Memory-Hard Function for Password Hashing and Proof-of-Work Applications. IETF. September 2021. sec. 7.4. doi:10.17487/RFC9106. RFC 9106. Retrieved 12 July 2023. <a href="https://datatracker.ietf.org/doc/html/rfc9106#section-7.4" target="_blank">https://datatracker.ietf.org/doc/html/rfc9106#section-7.4</a> <a href="#fnref:11" class="footnote-back-ref">↩</a></li>
<li id="fn:12">Biryukov, Alex; Dinu, Daniel; Khovratovich, Dmitry; Josefsson, Simon (September 2021). "Argon2 Memory-Hard Function for Password Hashing and Proof-of-Work Applications". Retrieved September 9, 2021. <a href="https://www.rfc-editor.org/rfc/rfc9106.html" target="_blank">https://www.rfc-editor.org/rfc/rfc9106.html</a> <a href="#fnref:12" class="footnote-back-ref">↩</a></li>
<li id="fn:13">"Password Storage Cheat Sheet". OWASP Cheat Sheet Series. OWASP. Retrieved 2023-05-17. <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html" target="_blank">https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html</a> <a href="#fnref:13" class="footnote-back-ref">↩</a></li>
<li id="fn:14">"Password Storage Cheat Sheet". OWASP Cheat Sheet Series. OWASP. Retrieved 2023-05-17. <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html" target="_blank">https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html</a> <a href="#fnref:14" class="footnote-back-ref">↩</a></li>
<li id="fn:15">"Password Storage Cheat Sheet". OWASP Cheat Sheet Series. OWASP. Retrieved 2023-05-17. <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html" target="_blank">https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html</a> <a href="#fnref:15" class="footnote-back-ref">↩</a></li>
</ol>

Argon2 open-in-new

Argon2