Argon2id
Argon2id is a memory-hard key derivation function designed to resist both time-memory trade-off attacks and side-channel attacks. It was selected as the winner of the Password Hashing Competition (PHC) in 2015 and is defined in RFC 9106. VeraCrypt supports Argon2id as an alternative to PBKDF2-HMAC for header key derivation.
Key Features
-
Memory-hard: Requires a configurable amount of memory, making it resistant to specialized hardware attacks
-
Side-channel resistant: Combines data-dependent and data-independent memory access patterns
-
Internal hash function: Uses BLAKE2b internally, eliminating the need for separate hash algorithm selection
-
Tunable parameters: Allows adjustment of memory cost, time cost, and parallelism
Argon2 Variants
Argon2 has three variants:
-
Argon2d: Uses data-dependent memory access, resistant to time-memory trade-off attacks but vulnerable to side-channel attacks
-
Argon2i: Uses data-independent memory access, resistant to side-channel attacks but more vulnerable to time-memory trade-off attacks
-
Argon2id: Hybrid approach that combines both variants, providing resistance to both attack types (used by VeraCrypt)
Parameters in VeraCrypt
VeraCrypt uses Argon2id with the following parameter configuration:
Memory Cost (m_cost)
The amount of memory used during the key derivation process, controlled by the PIM value:
-
Formula: m_cost(pim) = min(64 MiB + (pim - 1) × 32 MiB, 1024 MiB)
-
Range: 64 MiB to 1024 MiB (capped at PIM = 31)
-
Default: 96 MiB (equivalent to PIM = 2)
Time Cost (t_cost)
The number of iterations performed during the key derivation process:
-
For PIM ≤ 31: t_cost(pim) = 3 + floor((pim - 1) / 3)
-
For PIM > 31: t_cost(pim) = 13 + (pim - 31)
-
Default: 3 iterations (equivalent to PIM = 2)
Parallelism
The number of parallel threads used during computation:
-
Value: Fixed at 1 thread for all cases in VeraCrypt
-
Rationale: Ensures consistent behavior across different hardware configurations
Advantages over PBKDF2
-
Memory hardness: Requires significant memory allocation, making GPU and ASIC attacks more expensive
-
Modern design: Specifically designed to resist contemporary attack methods
-
Side-channel resistance: Built-in protections against cache-timing and other side-channel attacks
-
Standardization: Officially standardized in RFC 9106
Usage Considerations
When using Argon2id in VeraCrypt:
-
Memory requirements: Ensure sufficient RAM is available, especially with higher PIM values
-
Performance: Higher memory costs may result in slower mounting times but provide better security
-
Compatibility: Available in VeraCrypt versions that support multiple key derivation functions
-
No hash selection: Unlike PBKDF2-HMAC, no separate hash algorithm needs to be chosen
Technical Specifications
Algorithm: Argon2id as defined in RFC 9106
Internal hash: BLAKE2b
Salt size: 512 bits (same as PBKDF2-HMAC)
Output length: Variable, depending on the encryption algorithm (e.g., 256 bits for AES-256, 768 bits for AES-Twofish-Serpent cascade)
Version: Argon2 version 0x13 (19 decimal)
