argon2

Winner of the 2015 Password Hashing Competition. The CURRENT recommendation for new code.

Three variants:

• argon2d: data-dependent. Resists GPU attacks BUT vulnerable to side-channel timing attacks.
• argon2i: data-INdependent. Side-channel resistant. Slightly weaker against GPU.
• argon2id: hybrid. RECOMMENDED.

Memory-hard: requires lots of RAM during hashing. Hardware attackers must build memory-rich silicon, much more expensive than GPU-pure attacks.

Three tuning parameters:

• memory (KB) — how much RAM to use. OWASP recommends 19 MiB minimum (m=19456).
• iterations (t) — passes over the memory. OWASP: t=2.
• parallelism (p) — concurrent threads. Typically 1.

Format:

$argon2id$v=19$m=65536,t=3,p=4$<salt>$<hash>

Modern OWASP recommendations (2024):

• argon2id: m=19MiB, t=2, p=1 — minimum
• argon2id: m=12MiB, t=3, p=1 — alternative
• bcrypt: cost 10+ minimum, 12+ preferred

Use the argon2-cffi (Python), node-argon2, argon2-go libraries. Don't roll your own — implementation is subtle.