phc-winner-argon2

I agree, but you literally have no other option: https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypt... Web cryptography is stuck in the 1990s. PBKDF2 is the only available algorithm, which gives an attacker's GPUs a big advantage over honest users, let alone ASICs. Maybe a webassembly-based solution, implementing something like Bcrypt or Scrypt/Argon2, is comparable to a browser-native implementation, but that would have to be verified before taking my word for it. These algorithms provide varying amounts of memory-hardness (Bcrypt only 4KB but even that proved surprisingly effective), which causes contention on the GPU memory bus (they're only a bit faster than the CPU's memory bus, making the GPU have only a small advantage, on the order of 5x instead of 100x) and causes larger ASIC die sizes (which the Argon2 paper argues is

> Is there anything stronger than blowfish? I think you mean bcrypt.. Both Argon2 and scrypt win over that: https://github.com/P-H-C/phc-winner-argon2 https://www.tarsnap.com/scrypt.html

> Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt. Use argon2. Use argon2. Use argon2. Use argon2. Use argon2. Use argon2. Use argon2. Use argon2. Use argon2. https://github.com/P-H-C/phc-winner-argon2

Gate keeping is a double edged, and somewhat blunt, sword. First, some Maverick is going to ignore what everyone says and implement crypto for serious applications. Like yours truly. Second, I've seen it go a bit too far when I implemented Argon2i: there was a discrepancy between the specs and the reference implementations, and the authors haven't corrected the specs. I figured this was because not enough independent implementers bugged them about that. (Now, 3 years later, the specs still aren't fixed, so maybe the authors are really really busy. At least but the issue is still open: https://github.com/P-H-C/phc-winner-argon2/issues/183 )

> are they slow because they are computationally intensive... In general, no. Most "slow" hashing schemes are designed to be memory-hard and highly serial (more threads = more contention, not throughput). Some of the earlier approaches just try to maximize computational requirements, but modern research acknowledges the march of computing power makes that an inherently poor choice for long term sensitive data. Argon2 is just one of the more advanced versions of a memory-hard scheme, building on prior research. I could try to give a poor explanation, but instead I'll link you the spec which is very readable: https://github.com/P-H-C/phc-winner-argon2/blob/master/argon...

You can always make a fast hashing algorithm into a slow-enough password hashing algorithm by repeating it multiple times (as with PBKDF2) or better yet using a construction that also uses a minimum amount of memory, not just computational time. For most cryptographic applications (signing data in transit, signing data at rest, computing things like Merkle trees for applications like git and dm-verity), you want a hash that is fast to compute. It's basically only password hashing and cryptocurrency mining that needs to be slow. BLAKE3's readme says: (https://github.com/BLAKE3-team/BLAKE3) NOTE: BLAKE3 is not a password hashing algorithm, because it's designed to be fast, whereas password hashing should not be fast. If you hash passwords to store the hashes or if you derive keys from passwords, we recommend Argon2. Argon2 (https://github.c

Those who deployed Argon2 must have deployed the reference implementation, therefore the code became the de facto standard. Khovratovich confirmed in https://github.com/P-H-C/phc-winner-argon2/issues/183#issuec... that the code is the de facto standard and the spec will be edited to reflect this. libsodium implemented the same behavior simply because it reused the Argon2 reference implementation.

I agree, but it's actually hard not to nerf scrypt, since it's time-cost and memory-cost are tied together. I'm not sure if they could have increased the memory cost sufficiently for their purposes, without making the time cost prohibitively high. That's one of the things argon2 (https://github.com/P-H-C/phc-winner-argon2) is trying to fix, though I don't think any cryptocurrencies are using it yet (which is reasonable, it's just too young)

btw Argon2 https://github.com/P-H-C/phc-winner-argon2 is better than bcrypt for passwords hashing

General-purpose cryptographic hash functions like the (now-broken) MD5, SHA1, SHA256, etc. are designed to be computationally easy, ie. fast. Salting protects against rainbow tables [1], but it doesn't change the fact that computing a SHA256 hash is fast. Password hash functions like PBKDF2, bcrypt, scrypt, Argon2 are designed to be computationally expensive, to make a password-cracking endeavor take even longer. Argon2, the winner of the Password Hashing Competition and the current state-of-the-art, for example, has two ready-made variants: Argon2d is more resistant to GPU cracking, while Argon2i is more resistant to time-memory tradeoff attacks [2]. [1] https://en.wikipedia.org/wiki/Rainbow_table [2] https://github.com/p-h-c/phc-winner-argon2

Additionally, there's a new player in town called Argon2 that attempts to solve the problems with bcrypt and scrypt. It's the most recent winner of the password hashing competition. https://github.com/P-H-C/phc-winner-argon2

The reference library we do have looks set to make further breaking changes[0], which complicates this further. [0] https://github.com/P-H-C/phc-winner-argon2/pull/119/files

they should be adopting Argon2 I'm saying this as a proponent of Argon2, who has invested a lot of time trying to improve the codebase[0]. It currently isn't ready in large production. Efforts to stabilise the API are being spearheaded by someone apparently outside the project[1]. If you're reading this @lucab, thank you. In the meantime, my Ruby bindings have been broken on three separate occasions due to API changes. You could easily say "Don't track master", but the one release has a tag of 20151206, and it's just an arbitrary a tag as any particular commit id. There is no branch from which you could apply "bugfix only" updates. Two separate commits broke compilation. This commit[2] was a shambles. Most importantly, they have commits going in two days ago that change the test vectors[3]. That means if you update your library, verifyin

https://github.com/P-H-C/phc-winner-argon2 is the official repo.