[Paper Review] Open Sesame: The Password Hashing Competition and Argon2

Jos Wetzels|arXiv (Cornell University)|Feb 8, 2016

User Authentication and Security Systems11 references3 citations

TL;DR

This paper presents Argon2, the winner of the Password Hashing Competition (PHC), designed to securely hash passwords with resistance to both side-channel and GPU-based attacks. It introduces a memory-hard, adaptive hashing algorithm that balances security, performance, and configurability across diverse deployment environments.

ABSTRACT

In this document we present an overview of the background to and goals of the Password Hashing Competition (PHC) as well as the design of its winner, Argon2, and its security requirements and properties.

Motivation & Objective

• Address the growing need for secure, modern password hashing algorithms resistant to modern hardware attacks.
• Design a password hashing function that is both memory-hard and computationally efficient for practical deployment.
• Provide a flexible, configurable algorithm that adapts to different threat models and system constraints.
• Ensure resistance to side-channel attacks through constant-time implementation properties.
• Establish a standardized, cryptographically robust solution through the Password Hashing Competition (PHC) framework.

Proposed method

• Design Argon2 as a memory-hard cryptographic hash function using a data-dependent, memory-intensive mixing process.
• Employ a two-phase structure: initialization with key derivation and data-dependent mixing using a permutation-based mixing function.
• Introduce configurable parameters for memory cost, time cost, and parallelism to tune security and performance.
• Use a secure, data-dependent memory access pattern to resist time-memory trade-off attacks.
• Ensure constant-time execution to prevent side-channel leakage through timing or power analysis.
• Optimize for both CPU and GPU resistance by making memory access patterns unpredictable and data-dependent.

Experimental results

Research questions

• RQ1 How can a password hashing function be designed to be both memory-hard and secure against side-channel attacks?
• RQ2 What configuration parameters are necessary to balance security, performance, and resistance to GPU-based attacks?
• RQ3 Can a single algorithm effectively serve diverse deployment environments with varying threat models?
• RQ4 How does Argon2 compare to existing password hashing schemes in terms of resistance to time-memory trade-offs?
• RQ5 What are the practical implications of using data-dependent memory access for real-world security?

Key findings

• Argon2 was selected as the winner of the Password Hashing Competition due to its strong security properties and configurability.
• The algorithm provides resistance to time-memory trade-off attacks by requiring a large, unpredictable memory footprint.
• Argon2's design ensures constant-time execution, mitigating side-channel vulnerabilities such as timing and power analysis.
• The algorithm supports fine-grained configuration of memory cost, time cost, and parallelism, enabling deployment across diverse systems.
• Benchmarking showed that Argon2 achieves high security with acceptable performance on modern CPUs, even under constrained environments.
• The data-dependent memory access pattern prevents precomputation attacks and enhances resistance to GPU-based password cracking.