Using Argon2 Command for Cryptographic Hashes (with examples)

Argon2 is a key derivation function that was declared the winner of the Password Hashing Competition in July 2015. It’s designed to replace older algorithms like PBKDF2, bcrypt, and scrypt. Argon2 offers data-independent and data-dependent memory access, making it resistant against both GPU cracking attacks and tradeoff attacks. It also provides three versions: Argon2d, Argon2i, and Argon2id, which serve different purposes in terms of resistance to certain types of attacks.

In this article, I’ll illustrate various use cases of the Argon2 command-line tool, explaining each with examples and detailed information on the parameters used.

Use case 1: Calculate a hash with a password and a salt with the default parameters

Code:

echo "password" | argon2 "salt_text"

Motivation: Using the default parameters of Argon2 is an excellent starting point for users who are new to cryptographic hashing or do not have specific security needs that necessitate customized parameters. It allows users to quickly generate a secure hash without delving into complex configurations.

Explanation:

• echo "password": This command echoes the string “password,” which is passed as input to the Argon2 command.
• argon2 "salt_text": Invokes the Argon2 command with “salt_text” as the salt. The salt is a random value that ensures unique hashes for identical passwords, enhancing security by preventing pre-computed hash attacks.

Example Output:

Type:           Argon2id
Iterations:     2
Memory:         65536 KiB
Parallelism:    1
Hash:           03a3d14c4a40...
Encoded:        $argon2id$v=19$m=65536,t=2,p=1$...

Use case 2: Calculate a hash with the specified algorithm

Code:

echo "password" | argon2 "salt_text" -d

Motivation: Specifying the algorithm type allows one to tailor the hash function to meet specific requirements, such as increased resistance to side-channel attacks with Argon2i or resistance to GPU cracks with Argon2d. Each algorithm offers different strengths; being able to specify which one to use provides flexibility for enhancing security precisely as needed.

Explanation:

• "-d": This flag specifies that the Argon2d algorithm should be used. Argon2d is more resistant to GPU-based cracking but is vulnerable to side-channel attacks, making it suitable for certain server-side password hashing.

Example Output:

Type:           Argon2d
Iterations:     2
Memory:         65536 KiB
Parallelism:    1
Hash:           4d556e5755ad...
Encoded:        $argon2d$v=19$m=65536,t=2,p=1$...

Use case 3: Display the output hash without additional information

Code:

echo "password" | argon2 "salt_text" -e

Motivation: In some scenarios, users may require only the hash output without any additional metadata, such as when storing hashes for faster lookup or when the metadata is managed separately. This use case caters to the need for a clean, raw hash output for such purposes.

Explanation:

• "-e": This option means that only the encoded hash is displayed, removing any ancillary details like the type of Argon2, iterations, memory usage, etc.

Example Output:

$argon2id$v=19$m=65536,t=2,p=1$...

Use case 4: Calculate a hash with given iteration [t]imes, [m]emory usage, and [p]arallelism parameters

Code:

echo "password" | argon2 "salt_text" -t 5 -m 20 -p 7

Motivation: Customizing Argon2 parameters allows balancing between security and performance. Setting specific values for iterations, memory, and parallelism permits users to optimize the cryptographic process according to their environment. For example, increasing iterations and memory usage enhances security at the cost of time and resources, which is crucial for high-security applications.

Explanation:

• "-t 5": Indicates that the algorithm will run for five iterations, meaning the password will be hashed five times. Higher iteration counts slow down the hashing process, providing more security.
• "-m 20": Sets the memory usage to 2^20 KiB. More memory usage can mitigate parallel attacks significantly.
• "-p 7": Specifies the number of threads for parallel processing. Using higher parallelism levels makes full use of modern multi-core CPUs, speeding up the hash generation while resisting parallel attacks.

Example Output:

Type:           Argon2id
Iterations:     5
Memory:         1048576 KiB
Parallelism:    7
Hash:           bd2a1f4c5d4e...
Encoded:        $argon2id$v=19$m=1048576,t=5,p=7$...

Conclusion:

Argon2 is a powerful and flexible hashing algorithm, providing users with robust security options. From using default settings for ease of use to tweaking parameters for customized security, Argon2 maintains a flexible approach to a wide variety of password hashing requirements. Whether you’re looking to enhance security against specific attack vectors or simply secure user passwords, understanding and effectively executing the Argon2 command-line tool opens new doors in safeguarding sensitive information.