{{위키데이터 속성 추적}}
'''Argon2'''는 2015년 7월 [[암호 해싱 대회]]에서 우승작으로 선정된 [[키 유도 함수]]이다.<ref>[https://password-hashing.net/ "Password Hashing Competition"]</ref><ref>{{ArXiv 인용|authors=Jos Wetzels |date=2016-02-08 |title=Open Sesame: The Password Hashing Competition and Argon2 |class=cs.CR |eprint=1602.03097 |url=https://eprint.iacr.org/2016/104.pdf }}</ref> 설계자는 [[룩셈부르크 대학교]]의 [[Alex Biryukov]], Daniel Dinu, [[Dmitry Khovratovich]]이다.<ref>[https://password-hashing.net/argon2-specs.pdf Argon2: the memory-hard function for password hashing and other applications], Alex Biryukov, et al, October 1, 2015</ref> Argon2의 참조 구현체는 크리에이티브 커먼즈 [[크리에이티브 커먼즈 라이선스|CC0]]([[퍼블릭 도메인]]) 또는 [[아파치 라이선스|아파치 라이선스 2.0]]으로 배포되며 이와 관련된 3개의 버전을 제공한다:

* Argon2d: GPU 크래킹 공격의 저항성을 극대화한다.
* Argon2i: 사이드 채널 공격 저항에 최적화되어 있다. 암호와 독립된 순서로 메모리 배열에 접근한다.
* Argon2id: 하이브리드 버전. 메모리 처음 절반을 Argon2i이 접근하고 이후 패스는 Argon2d가 접근한다.

이 모드 3개는 모두 3개의 통제 변수를 사용한다:
* 실행 시간
* 필요한 메모리
* 병렬 수준

== 알고리즘 ==

 <span style="color:blue;">'''Function'''</span> Argon2
    <span style="color:blue;">'''Inputs:'''</span>
       password ('''P'''):       Bytes (0..2<sup>32</sup>-1)    <span style="color:green;">Password (or message) to be hashed</span>
       salt ('''S'''):           Bytes (8..2<sup>32</sup>-1)    <span style="color:green;">Salt (16 bytes recommended for password hashing)</span>
       parallelism ('''p'''):    Number (1..2<sup>24</sup>-1)   <span style="color:green;">Degree of parallelism (i.e. number of threads)</span>
       tagLength ('''T'''):      Number (4..2<sup>32</sup>-1)   <span style="color:green;">Desired number of returned bytes</span>
       memorySizeKB ('''m'''):   Number (8p..2<sup>32</sup>-1)  <span style="color:green;">Amount of memory (in [[바이트|kibibytes]]) to use</span>
       iterations ('''t'''):     Number (1..2<sup>32</sup>-1)   <span style="color:green;">Number of iterations to perform</span>
       version ('''v'''):        Number (0x13)<sup>  </sup>     <span style="color:green;">The current version is 0x13 (19 decimal)</span>
       key ('''K'''):            Bytes (0..2<sup>32</sup>-1)    <span style="color:green;">Optional key (Errata: PDF says 0..32 bytes, RFC says 0..2<sup>32</sup> bytes)</span>
       associatedData ('''X'''): Bytes (0..2<sup>32</sup>-1)    <span style="color:green;">Optional arbitrary extra data</span>
       hashType ('''y'''):       Number (0=Argon2d, 1=Argon2i, 2=Argon2id)
    <span style="color:blue;">'''Output:'''</span>
       tag:                Bytes (tagLength)<sup>  </sup> <span style="color:green;">The resulting generated bytes, tagLength bytes long</span>

    <span style="color:green;">''Generate initial 64-byte block H<sub>0</sub>.''
     All the input parameters are concatenated and input as a source of additional entropy.
     Errata: RFC says H<sub>0</sub> is 64-bits; PDF says H<sub>0</sub> is 64-bytes.
     Errata: RFC says the Hash is H^, the PDF says it's ℋ (but doesn't document what ℋ is). It's actually Blake2b.
     Variable length items are prepended with their length as 32-bit little-endian integers.</span>
    buffer ← parallelism ∥ tagLength ∥ memorySizeKB ∥ iterations ∥ version ∥ hashType
          ∥ Length(password)       ∥ Password
          ∥ Length(salt)           ∥ salt
          ∥ Length(key)            ∥ key
          ∥ Length(associatedData) ∥ associatedData
    H<sub>0</sub> ← Blake2b(buffer, 64) <span style="color:green;">''//default hash size of Blake2b is 64-bytes''</span>

    <span style="color:green;">Calculate number of 1&nbsp;KB blocks by rounding down memorySizeKB to the nearest multiple of 4*parallelism [[바이트|kibibytes]]</span>
    blockCount ← Floor(memorySizeKB, 4*parallelism)

    <span style="color:green;">Allocate two-dimensional array of 1&nbsp;KiB blocks (parallelism rows x columnCount columns)</span>
    columnCount ← blockCount / parallelism;   <span style="color:green;">//In the RFC, columnCount is referred to as '''q'''</span>

    <span style="color:green;">Compute the first and second block (i.e. column zero and one ) of each lane (i.e. row)</span>
    '''for''' i ← 0 '''to''' parallelism-1 '''do''' <span style="color:green;">for each row</span>
       B<sub>i</sub>[0] ← Hash(H<sub>0</sub> ∥ 0 ∥ i, 1024) <span style="color:green;">''//Generate a 1024-byte digest''</span>
       B<sub>i</sub>[1] ← Hash(H<sub>0</sub> ∥ 1 ∥ i, 1024) <span style="color:green;">''//Generate a 1024-byte digest''</span>

    <span style="color:green;">Compute remaining columns of each lane</span>
    '''for''' i ← 0 '''to''' parallelism-1 '''do''' <span style="color:green;">//for each row</span>
       '''for''' j ← 2 '''to''' columnCount-1 '''do''' <span style="color:green;">//for each subsequent column</span>
          <span style="color:green;">//i' and j' indexes depend if it's Argon2i, Argon2d, or Argon2id (See section 3.4)</span>
          i′, j′ ← GetBlockIndexes(i, j)  <span style="color:green;">//the GetBlockIndexes function is not defined</span>
          B<sub>i</sub>[j] = G(B<sub>i</sub>[j-1], B<sub>i′</sub>[j′]) <span style="color:green;">//the G hash function is not defined</span>

    <span style="color:green;">Further passes when iterations > 1</span>
    '''for''' nIteration ← 2 '''to''' iterations '''do'''
       '''for''' i ← 0 '''to''' parallelism-1 '''do''' <span style="color:green;">for each row</span>
         '''for''' j ← 0 '''to''' columnCount-1 '''do''' <span style="color:green;">//for each subsequent column</span>
            <span style="color:green;">//i' and j' indexes depend if it's Argon2i, Argon2d, or Argon2id (See section 3.4)</span>
            i′, j′ ← GetBlockIndexes(i, j)
            '''if''' j == 0 '''then'''
              B<sub>i</sub>[0] = B<sub>i</sub>[0] xor G(B<sub>i</sub>[columnCount-1], B<sub>i′</sub>[j′])
            '''else'''
              B<sub>i</sub>[j] = B<sub>i</sub>[j] xor G(B<sub>i</sub>[j-1], B<sub>i′</sub>[j′])

    <span style="color:green;">Compute final block '''C''' as the XOR of the last column of each row</span>
    C ← B<sub>0</sub>[columnCount-1]
    '''for''' i ← 1 '''to''' parallelism-1 '''do'''
       C ← C '''xor''' B<sub>i</sub>[columnCount-1]

    <span style="color:green;">Compute output tag</span>
    '''return''' Hash(C, tagLength)

== 각주 ==
{{각주}}

== 외부 링크 ==
* [https://github.com/p-h-c/phc-winner-argon2 Argon2 source code repository on Github]
* [https://www.cryptolux.org/images/0/0d/Argon2.pdf Argon2 specification]
* [https://password-hashing.net/ Password Hashing Competition]
* [https://www.cryptolux.org/index.php/Argon2 Uni.Lu Argon2 Page]
* [https://eprint.iacr.org/2016/027.pdf Balloon Hashing: A Memory-Hard Function Providing Provable Protection Against Sequential Attacks]

{{암호화 해시}}

[[분류:키 유도 함수]]
[[분류:2015년 컴퓨팅]]