Argon2

This is the reference C implementation of Argon2, the password-hashing function that won the Password Hashing Competition (PHC). Argon2 is a password-hashing function that summarizes the state of the art in the design of memory-hard functions and can be used to hash passwords for credential storage, key derivation, or other applications. It has a simple design aimed at the highest memory filling rate and effective use of multiple computing units, while still providing defense against tradeoff attacks (by exploiting the cache and memory organization of the recent processors). Argon2 has three variants: Argon2i, Argon2d, and Argon2id. Argon2d is faster and uses data-depending memory access, which makes it highly resistant against GPU cracking attacks and suitable for applications with no threats from side-channel timing attacks (eg. cryptocurrencies). Argon2i instead uses data-independent memory access, which is preferred for password hashing and password-based key derivation, but it is slower as it makes more passes over the memory to protect from tradeoff attacks. Argon2id is a hybrid of Argon2i and Argon2d, using a combination of data-depending and data-independent memory accesses, which gives some of Argon2i's resistance to side-channel cache timing attacks and much of Argon2d's resistance to GPU cracking attacks. make builds the executable argon2 , the static library libargon2.a , and the shared library libargon2.so (or on macOS, the dynamic library libargon2.dylib -- make sure to specify the installation prefix when you compile: make PREFIX=/usr ). Make sure to run make test to verify that your build produces valid results. sudo make install PREFIX=/usr installs it to your system. libargon2 provides an API to both low-level and high-level functions for using Argon2. The example program below hashes the string "password" with Argon2i using the high-level API and then using the low-level API. While the high-level API takes the three cost parameters (time, memory, and parallelism), the password input buffer, the salt input buffer, and the output buffers, the low-level API takes in these and additional parameters , as defined in include/argon2.h . There are many additional parameters, but we will highlight three of them here. 1. The secret parameter, which is used for keyed hashing. This allows a secret key to be input at hashing time (from some external location) and be folded into the value of the hash. This means that even if your salts and hashes are compromised, an attacker cannot brute-force to find the password without the key. 2. The ad parameter, which is used to fold any additional data into the hash value. Functionally, this behaves almost exactly like the secret or salt parameters; the ad parameter is folding into the value of the hash. However, this parameter is used for different data. The salt should be a random string stored alongside your password. The secret should be a random key only usable at hashing time. The ad is for any other data. 3. The flags parameter, which determines which memory should be securely erased. This is useful if you want to securely delete the pwd or secret fields right after they are used. To do this set flags to either ARGON2 FLAG CLEAR PASSWORD or ARGON2 FLAG CLEAR SECRET . To change how internal memory is cleared, change the global flag FLAG clear internal memory (defaults to clearing internal memory). Compile for example as gcc test.c libargon2.a -Isrc -o test , if the program below is named test.c and placed in the project's root directory. To use Argon2d instead of Argon2i call argon2d hash raw instead of argon2i hash raw using the high-level API, and argon2d instead of argon2i using the low-level API. Similarly for Argon2id, call argon2id hash raw and argon2id . Note: in this example the salt is set to the all- 0x00 string for the sake of simplicity, but in your application you should use a random salt. There are two sets of test suites. One is a low level test fo