Re: [openpgp] Memory requirement for Argon2 (draft-06, sec 3.7.1.4)

[Daniel Huigens <[e-mail]>]

Hi Bruce,

Since Argon2 is a symmetric construct, as a first assumption I think
it's not unreasonable to say that the file will most likely be
decrypted on the same device it was encrypted on. Of course, that won't
always be the case, but if it's not it's not the end of the world, it
will just be slower (or faster).

In my opinion, the first recommended option should be fine, if the
implementation doesn't know about the hardware that will be used to
decrypt. The reason we don't standardize it is because these
recommendations might change in the future.

> Another thing I don't know, how much memory is required before the
> memory advantage provided by Argon2 is actually effective and
> helpful? Would there come a point where Argon2 provides no value
> over, say, "Iterated and Salted S2K"?

Argon2 is intended to provide the maximum amount of security for any
given amount of computing resources. So in principle Argon2 should be
more secure than Iterated+Salted S2K for any set of "equivalent"
parameters.

> With the current draft, an implementation generating an Argon2 value
> can specify a memory requirement all the way up to 2 TB. Is this a
> good idea? Or should the requirement be limited to something
> reasonable?

The decrypting implementation doesn't necessarily have to allocate 2TB,
it can do with less, it will just be slow. If an application is
decrypting files from untrusted sources, and resource usage is a
concern, it might want to limit the resource usage here (similarly to
how it might want to limit the file size). Also, in this scenario using
asymmetric crypto seems more likely.

Best,
Daniel