Argon2

Argon2 is a key derivation function that was selected as the winner of the 2015 Password Hashing Competition.^[1]^[2] It was designed by Alex Biryukov, Daniel Dinu, and Dmitry Khovratovich from the University of Luxembourg.^[3] The reference implementation of Argon2 is released under a Creative Commons CC0 license (i.e. public domain) or the Apache License 2.0, and provides three related versions:

Argon2d maximizes resistance to GPU cracking attacks. It accesses the memory array in a password dependent order, which reduces the possibility of time–memory trade-off (TMTO) attacks, but introduces possible side-channel attacks.
Argon2i is optimized to resist side-channel attacks. It accesses the memory array in a password independent order.
Argon2id is a hybrid version. It follows the Argon2i approach for the first half pass over memory and the Argon2d approach for subsequent passes. RFC 9106 recommends using Argon2id if you do not know the difference between the types or you consider side-channel attacks to be a viable threat.^[4]

This article relies excessively on references to primary sources. (January 2016)

Quick Facts General, Designers ...

Argon2
General
Designers	Alex Biryukov Daniel Dinu Dmitry Khovratovich
First published	2015; 10 years ago (2015)
Cipher detail
Digest sizes	variable
Block sizes	variable
Rounds	variable

All three modes allow specification by three parameters that control:

execution time
memory required
degree of parallelism

Source:^[4]

Function Argon2
   Inputs:
      password (P):       Bytes (0..2³²-1)    Password (or message) to be hashed
      salt (S):           Bytes (8..2³²-1)    Salt (16 bytes recommended for password hashing)
      parallelism (p):    Number (1..2²⁴-1)   Degree of parallelism (i.e. number of threads)
      tagLength (T):      Number (4..2³²-1)   Desired number of returned bytes
      memorySizeKB (m):   Number (8p..2³²-1)  Amount of memory (in kibibytes) to use
      iterations (t):     Number (1..2³²-1)   Number of iterations to perform
      version (v):        Number (0x13)     The current version is 0x13 (19 decimal)
      key (K):            Bytes (0..2³²-1)    Optional key (Errata: PDF says 0..32 bytes, RFC says 0..2³² bytes)
      associatedData (X): Bytes (0..2³²-1)    Optional arbitrary extra data
      hashType (y):       Number (0=Argon2d, 1=Argon2i, 2=Argon2id)
   Output:
      tag:                Bytes (tagLength) The resulting generated bytes, tagLength bytes long

   Generate initial 64-byte block H₀.
    All the input parameters are concatenated and input as a source of additional entropy.
    Errata: RFC says H₀ is 64-bits; PDF says H₀ is 64-bytes.
    Errata: RFC says the Hash is H^, the PDF says it's ℋ (but doesn't document what ℋ is). It's actually Blake2b.
    Variable length items are prepended with their length as 32-bit little-endian integers.
   buffer ← parallelism ∥ tagLength ∥ memorySizeKB ∥ iterations ∥ version ∥ hashType
         ∥ Length(password)       ∥ Password
         ∥ Length(salt)           ∥ salt
         ∥ Length(key)            ∥ key
         ∥ Length(associatedData) ∥ associatedData
   H₀ ← Blake2b(buffer, 64) //default hash size of Blake2b is 64-bytes

   Calculate number of 1 KB blocks by rounding down memorySizeKB to the nearest multiple of 4*parallelism kibibytes
   blockCount ← Floor(memorySizeKB, 4*parallelism)

   Allocate two-dimensional array of 1 KiB blocks (parallelism rows x columnCount columns)
   columnCount ← blockCount / parallelism;   //In the RFC, columnCount is referred to as q

   Compute the first and second block (i.e. column zero and one ) of each lane (i.e. row)
   for i ← 0 to parallelism-1 do for each row
      B_i[0] ← Hash(H₀ ∥ 0 ∥ i, 1024) //Generate a 1024-byte digest
      B_i[1] ← Hash(H₀ ∥ 1 ∥ i, 1024) //Generate a 1024-byte digest

   Compute remaining columns of each lane
   for i ← 0 to parallelism-1 do //for each row
      for j ← 2 to columnCount-1 do //for each subsequent column
         //i' and j' indexes depend if it's Argon2i, Argon2d, or Argon2id (See section 3.4)
         i′, j′ ← GetBlockIndexes(i, j)  //the GetBlockIndexes function is not defined
         B_i[j] = G(B_i[j-1], B_i′[j′]) //the G hash function is not defined

   Further passes when iterations > 1
   for nIteration ← 2 to iterations do
      for i ← 0 to parallelism-1 do for each row
        for j ← 0 to columnCount-1 do //for each subsequent column
           //i' and j' indexes depend if it's Argon2i, Argon2d, or Argon2id (See section 3.4)
           i′, j′ ← GetBlockIndexes(i, j)
           if j == 0 then 
             B_i[0] = B_i[0] xor G(B_i[columnCount-1], B_i′[j′])
           else
             B_i[j] = B_i[j] xor G(B_i[j-1], B_i′[j′])

   Compute final block C as the XOR of the last column of each row
   C ← B₀[columnCount-1]
   for i ← 1 to parallelism-1 do
      C ← C xor B_i[columnCount-1]

   Compute output tag
   return Hash(C, tagLength)

Variable-length hash function

Argon2 makes use of a hash function capable of producing digests up to 2³² bytes long. This hash function is internally built upon Blake2.

{{#parsoid\0fragment:1}}
 <span style="color:blue;">'''Function'''</span> Hash(message, digestSize)
    <span style="color:blue;">'''Inputs:'''</span>
       message:         Bytes (0..2<sup>32</sup>-1)     <span style="color:green;">Message to be hashed</span>
       digestSize:      Integer (1..2<sup>32</sup>)     <span style="color:green;">Desired number of bytes to be returned</span>
    <span style="color:blue;">Output:</span>
       digest:          Bytes (digestSize)<sup>  </sup> <span style="color:green;">The resulting generated bytes, digestSize bytes long</span>
 
    <span style="color:green;">'''Hash''' is a variable-length hash function, built using Blake2b, capable of generating
    digests up to 2<sup>32</sup> bytes.</span>
 
    <span style="color:green;">If the requested digestSize is 64-bytes or lower, then we use Blake2b directly</span>
    '''if''' (digestSize <= 64) '''then'''
       '''return''' Blake2b(digestSize ∥ message, digestSize) <span style="color:green;">// concatenate 32-bit little endian digestSize with the message bytes</span>
 
    <span style="color:green;">For desired hashes over 64-bytes (e.g. 1024 bytes for Argon2 blocks),
    we use Blake2b to generate twice the number of needed 64-byte blocks,
    and then only use 32-bytes from each block</span>
 
    <span style="color:green;">Calculate the number of whole blocks (knowing we're only going to use 32-bytes from each)</span>
    r ← Ceil(digestSize/32)-2;
 
    <span style="color:green;">Generate r whole blocks.</span>
    <span style="color:green;">Initial block is generated from message</span>
    V<sub>1</sub> ← Blake2b(digestSize ∥ message, 64);
    <span style="color:green;">Subsequent blocks are generated from previous blocks</span>
    '''for''' i ← 2 '''to''' r '''do'''
       V<sub>i</sub> ← Blake2b(V<sub>i-1</sub>, 64)
    <span style="color:green;">Generate the final (possibly partial) block</span>
    partialBytesNeeded ← digestSize – 32*r;
    V<sub>r+1</sub> ← Blake2b(V<sub>r</sub>, partialBytesNeeded)
 
    <span style="color:green;">Concatenate the first 32-bytes of each block V<sub>i</sub>
    (except the possibly partial last block, which we take the whole thing)</span>
    <span style="color:green;">Let A<sub>i</sub> represent the lower 32-bytes of block V<sub>i</sub></span>
    '''return''' A<sub>1</sub> ∥ A<sub>2</sub> ∥ ... ∥ A<sub>r</sub> ∥ V<sub>r+1</sub>

Cryptanalysis

Algorithm

Variable-length hash function

Recommended minimum parameters

References

External links

Wikiwand - on