Re: [Cfrg] Memory-efficient evaluation of data-independent memory-hard functions

[Bill Cox <[e-mail]>]

This is really excellent work.  We're still waiting I think, for an update
to Argon2i to fix a significant TMTO issue, but Argon2d with one-pass will
withstand the test of time, IMO.  For near-term use, if I were using Argon2
(I prefer Yescrypt in most cases), I would stick to Argon2id, which offers
some protection against certain cache-timing attacks, but still leaks
meta-data such as whether or not the user who is authenticating has been
seen before.  It also is possible for an attacker to guess the password
(with very much required computation*memory due to the data-independent
part) without having access to the password hash, but instead just the salt
and username.  AFAIK, Argon2id has the same memory*time defense as Argon2d,
so it seems like a no-brainer to use Argon2id rather than Argon2d, IMO.  If
the CFRG were to promote one single version of Argon2, I feel it should be
Argon2id, given the continued attacks against iMHFs.

In an attempt to use Argon2id in an actual application, I found that the
low-memory hashing I was doing (it fit into L3 cache) was too slow.
Argon2id seems fine for larger memory sizes.  Scrypt (and Yescrypt) can
easily be modified to do less computation per memory block with no known
loss of security, which makes them both more suitable for low-memory
applications.

Bill