Re: [openpgp] Memory requirement for Argon2 (draft-06, sec 3.7.1.4)

[Daniel Huigens <[e-mail]>]

You mention single-core performance leveling off, and then you mention
GPU/FPGA password crackers. That's indeed what causes the issue:
crackers using GPUs/FPGAs have a large advantage compared to users
using a single CPU core to hash their password. Memory-hard password
hashing algorithms like Argon2 aim to reduce this gap, by making
hashing using GPUs/FPGAs more expensive (and it also allows using
multiple cores to hash the password).

> The current question is: can Argon2 be adapted to provide some sort of
> practically usable improvement against those sorts of crackers in an
> OpenPGP environment.

Yes, I believe so. Do you have any concrete concerns why this might not
be the case?

Best,
Daniel