Argon2

Argon2 is a memory-hard password hashing and key derivation function designed to resist brute-force attacks using specialized hardware. It was created for the Password Hashing Competition and won the overall competition in 2015. Argon2 is intended for securely hashing passwords and deriving keys in various security-sensitive applications.

Argon2 achieves its security primarily through memory hardness, meaning that computing the hash requires a substantial amount of RAM. This makes large-scale password cracking with GPUs or ASICs more difficult and costly. Users can configure several parameters: memory cost (the amount of memory used), time cost (the number of iterations), and parallelism (the number of lanes or threads). The function also takes a salt and can incorporate optional secret values and associated data, producing a derived key of a desired length.

There are three variants of Argon2: Argon2d, Argon2i, and Argon2id. Argon2d uses data-dependent memory access, delivering fast performance but being potentially more vulnerable to side-channel attacks. Argon2i uses data-independent memory access, offering stronger protection against side-channel leakage but with slower performance. Argon2id is a hybrid that begins with a data-independent phase and then uses data-dependent access, aiming to balance security and efficiency. In practice, Argon2id is commonly recommended for password hashing due to its balanced security properties.

Argon2 has been widely adopted in cryptographic libraries and password-hashing APIs. It is supported by many programming languages and frameworks, with implementations in major libraries such as libsodium and various PHC-compliant tools. Its flexibility and strong security model have contributed to its prominence as a modern standard for password storage.