### On the Depth-Robustness and Cumulative Pebbling Cost of Argon2i

Jeremiah Blocki and Samson Zhou

##### Abstract

Argon2i is a data-independent memory hard function that won the password hashing competition. The password hashing algorithm has already been incorporated into several open source crypto libraries such as libsodium. In this paper we analyze the cumulative memory cost of computing Argon2i. On the positive side we provide a lower bound for Argon2i. On the negative side we exhibit an improved attack against Argon2i which demonstrates that our lower bound is nearly tight. In particular, we show that (1) An Argon2i DAG is $\left(e,O\left(n^3/e^3\right)\right))$-reducible. (2) The cumulative pebbling cost for Argon2i is at most $O\left(n^{1.768}\right)$. This improves upon the previous best upper bound of $O\left(n^{1.8}\right)$ [Alwen and Blocki, EURO S&P 2017]. (3) Argon2i DAG is $\left(e,\tilde{\Omega}\left(n^3/e^3\right)\right))$-depth robust. By contrast, analysis of [Alwen et al., EUROCRYPT 2017] only established that Argon2i was $\left(e,\tilde{\Omega}\left(n^2/e^2\right)\right))$-depth robust. (4) The cumulative pebbling complexity of Argon2i is at least $\tilde{\Omega}\left( n^{1.75}\right)$. This improves on the previous best bound of $\Omega\left( n^{1.66}\right)$ [Alwen et al., EUROCRYPT 2017] and demonstrates that Argon2i has higher cumulative memory cost than competing proposals such as Catena or Balloon Hashing. We also show that Argon2i has high {\em fractional} depth-robustness which strongly suggests that data-dependent modes of Argon2 are resistant to space-time tradeoff attacks.

##### Metadata
Available format(s)
Category
Secret-key cryptography
Publication info
Published by the IACR in TCC 2017
Keywords
Argon2iMemory Hard FunctionsDepth-Robustness
Contact author(s)
jblocki @ purdue edu
History
2017-09-22: last of 4 revisions
2017-05-23: received
See all versions
Short URL
https://ia.cr/2017/442
License

CC BY

BibTeX

@misc{cryptoeprint:2017/442,
author = {Jeremiah Blocki and Samson Zhou},
title = {On the Depth-Robustness and Cumulative Pebbling Cost of Argon2i},
howpublished = {Cryptology ePrint Archive, Paper 2017/442},
year = {2017},
note = {\url{https://eprint.iacr.org/2017/442}},
url = {https://eprint.iacr.org/2017/442}
}

Note: In order to protect the privacy of readers, eprint.iacr.org does not use cookies or embedded third party content.