'''Argon2'''는 2015년 7월 암호 해싱 대회에서 우승작으로 선정된 유도 함수이다. 설계자는 룩셈부르크 대학교의 Alex Biryukov, Daniel Dinu, Dmitry Khovratovich이다. Argon2의 참조 구현체는 크리에이티브 커먼즈 CC0(퍼블릭 도메인) 또는 아파치 라이선스 2.0으로 배포되며 이와 관련된 3개의 버전을 제공한다: Argon2d: GPU 크래킹 공격의 저항성을 극대화한다. Argon2i: 사이드 채널 공격 저항에 최적화되어 있다. 암호와 독립된 순서로 메모리 배열에 접근한다. Argon2id: 하이브리드 버전. 메모리 처음 절반을 Argon2i이 접근하고 이후 패스는 Argon2d가 접근한다. 모드 3개는 모두 3개의 통제 변수를 사용한다: 실행 시간 필요한 메모리 병렬 수준 == 알고리즘 == '''Function''' Argon2 '''Inputs:''' password ('''P'''): Bytes (0..232-1) Password (or message) to be hashed salt ('''S'''): Bytes (8..232-1) Salt (16 bytes recommended for password hashing) parallelism ('''p'''): Number (1..224-1) Degree of parallelism (i.e. number of threads) tagLength ('''T'''): Number (4..232-1) Desired number of returned bytes memorySizeKB ('''m'''): Number (8p..232-1) Amount of memory (in kibibytes) to use iterations ('''t'''): Number (1..232-1) Number of iterations to perform version ('''v'''): Number (0x13) The current version is 0x13 (19 decimal) key ('''K'''): Bytes (0..232-1) Optional key (Errata: PDF says 0..32 bytes, RFC says 0..232 bytes) associatedData ('''X'''): Bytes (0..232-1) Optional arbitrary extra data hashType ('''y'''): Number (0=Argon2d, 1=Argon2i, 2=Argon2id) '''Output:''' tag: Bytes (tagLength) The resulting generated bytes, tagLength bytes long ''Generate initial 64-byte block H0.'' All the input parameters are concatenated and input as source of additional entropy. Errata: RFC says H0 is 64-bits; PDF says H0 is 64-bytes. Errata: RFC says the Hash is H^, the PDF says it's (but doesn't document what is). It's actually Blake2b. Variable length items are prepended with their length as 32-bit little-endian integers. buffer parallelism tagLength memorySizeKB iterations version hashType Password Length(salt) salt Length(key) key associatedData H0 Blake2b(buffer, 64) ''//default hash size of Blake2b is 64-bytes'' Calculate number of KB blocks by rounding down memorySizeKB to the nearest multiple of 4*parallelism kibibytes blockCount 4*parallelism) Allocate two-dimensional array of KiB blocks (parallelism rows columnCount columns) columnCount blockCount parallelism; //In the RFC, columnCount is referred to as '''q''' Compute the first and second block (i.e. column zero and one of each lane (i.e. row) '''for''' '''to''' parallelism-1 '''do''' for each row Bi0 Hash(H0 i, 1024) ''//Generate 1024-byte digest'' Bi1 Hash(H0 i, 1024) ''//Generate 1024-byte digest'' Compute remaining columns of each lane '''for''' '''to''' parallelism-1 '''do''' //for each row '''for''' '''to''' columnCount-1 '''do''' //for each subsequent column //i' and j' indexes depend if it's Argon2i, Argon2d, or Argon2id (See section 3.4) i′, j′ j) //the GetBlockIndexes function is not defined Bij G(Bij-1, Bi′j′) //the hash function is not defined Further passes when iterations '''for''' nIteration '''to''' iterations '''do''' '''for''' '''to''' parallelism-1 '''do''' for each row '''for''' '''to''' columnCount-1 '''do''' //for each subsequent column //i' and j' indexes depend if it's Argon2i, Argon2d, or Argon2id (See section 3.4) i′, j′ j) '''if''' == '''then''' Bi0 Bi0 xor Bi′j′) '''else''' Bij Bij xor G(Bij-1, Bi′j′) Compute final block '''C''' as the XOR of the last column of each row B0columnCount-1 '''for''' '''to''' parallelism-1 '''do''' '''xor''' BicolumnCount-1 Compute output tag '''return''' Hash(C, tagLength) == 각주 == == 외부 링크 == Argon2 source code repository on Github Argon2 specification Password Hashing Competition Uni.Lu Argon2 Page Balloon Hashing: Memory-Hard Function Providing Provable Protection Against Sequential Attacks 분류:키 유도 함수 분류:2015년 컴퓨팅