Re: [openpgp] The Argon2 proposal seems incomplete (Draft 6)

[Bruce Walzer <[e-mail]>]

On Tue, Aug 02, 2022 at 04:58:59PM +0000, Daniel Huigens wrote:
> On Tuesday, August 2nd, 2022 at 12:16, Bruce Walzer wrote:
> 
> > I don't see this as a parameter problem. When Argon2 is used in
> > a normal way the parameters (CPU, threads, memory) are deliberately
> > set to, as much as is possible, prevent the hash from being done on
> > any other system.
> 
> This is not true at all. The first recommended parameter set is
> explicitly given as a "uniformly safe option that is not tailored to
> your application or hardware".

I can't help but point out that this is somewhat ambiguous as
stated. The first recommended parameter set in RFC 9106 is 2 lanes and
250 MB of RAM which is intended for cryptocurrency mining. From
context it is clear you meant the FIRST RECOMMENDED option which is 1
iteration, 4 lanes and 2 GiB of RAM. I am being deliberately difficult
here to highlight how vague this all is. The actual Argon2 proposal in
draft 6 doesn't recommend anything at all but merely suggests a place
where you might find some recommendations. Anyway to your point...

I was making a more general point. By the very nature of what we are
doing with Argon2 we are attempting to employ resources that an
attacker does not have in their context. What we might choose as a
default does not not change this fundamental principle.

[...]

> > This is true even to the extent that it is designed
> > to run badly on any other platform than x86.
> 
> Citation needed? Being optimized for the x86 architecture is not the
> same as being "designed to run badly on any other platform than x86".

It is obvious we are looking at the same thing, but a citation was
requested, so:

>From RFC 9106, sec 1:

>Argon2 is optimized for the x86 architecture and exploits the cache
>and memory organization of the recent Intel and AMD processors.


This is a password hashing function, absolute performance is irrelevant. Only performance relative to that achieved by an attacker is important. What possible reason would there be to heavily optimize Argon2 on x86 other than to make that platform the fastest relative to other platforms? In other words, to make it run worse on any other platforms.

Bruce