←back to thread

Evaluating Argon2 adoption and effectiveness in real-world software

(arxiv.org)
32 points pregnenolone | 3 comments | 15 Oct 25 06:29 UTC | HN request time: 0.577s | source
1. gregoriol ◴[22 Oct 25 14:13 UTC] No.45669484[source]▶
It seems that PHP, Symfony, ... have kept bcrypt as their preference even when Argon2 is available; is there a rationale there from such big projects?
replies(2): >>45671181 #>>45672603 #
2. upofadown ◴[22 Oct 25 16:02 UTC] No.45671181[source]▶
There is some thought that bcrypt is better than Argon2 for run times less than a second. So passwords in other words.
3. tptacek ◴[22 Oct 25 17:44 UTC] No.45672603[source]▶
bcrypt is fine. scrypt is fine. Argon2 is fine. Even PBKDF2, in most configurations, is fine. You can basically just put them on a board and throw a dart.