Argon2
Argon2 is a family of memory-intensive password hash functions. The variant, memory use and runtime must suit security and operational requirements.
Verify passwords with computational effort
Argon2 is a family of password hash functions deliberately requiring memory and computing time. This makes large-scale guessing against stolen password hashes more expensive. OWASP recommends the Argon2id variant for new password storage. A weak password can still be found by suitable guesses.
A fictional application stores a verification record produced by its library: the variant, parameters, salt and derived verification value. At sign-in, the library uses these details to check the entered password. It does not decrypt the original password from the stored value.
Treat parameters as an operational decision
The m parameter describes the configured total memory in kibibytes, t the number of passes and p the parallel computation lanes. The parallelism value is not an additional multiplier of the configured total memory. The actual time and memory consumed by an invocation must be investigated on the intended platform.
The team selects settings using current security guidance and measurements with the expected number of simultaneous sign-ins. Greater effort also makes legitimate password verification more expensive; if this overloads the server, availability suffers. An arbitrary default copied from an example does not replace that decision. The salt and parameters remain available alongside the verification value so that later sign-ins can be checked correctly.
Sources
Related terms
- Password saltingPassword salting gives each new password hash its own random additional value. The salt is stored alongside it and does not need to be secret.
- PasskeyA passkey enables sign-in with a service-bound key pair. Device changes, account recovery and account permissions remain separate responsibilities.
- HttpOnly cookieHttpOnly prevents direct cookie access by page scripts. Matching requests can still carry the cookie; session and permission checks remain necessary.
- Data minimisationData minimisation limits personal data to what is adequate, relevant and necessary for a defined purpose.
- Data retention policyA data retention policy defines the purpose, start, duration and end of storage. Deletion jobs and copies must be addressed in the implementation.
- Envelope encryptionEnvelope encryption separates the data key from the key protecting it. The encrypted file and wrapped data key need to be managed together.
Your project with ASES
Describe your project to us. We will get back to you with an initial assessment.