Key Derivation Functions: PBKDF2 and Argon2id

Published on 18/04/2025

WHAT IS A KEY DERIVATION FUNCTION?

A key derivation function (KDF) is an algorithm that transforms a password into a cryptographic key suitable for encryption operations. Unlike standard hash functions, KDFs are specifically designed to resist brute force and dictionary attacks by making the process intentionally slow and resource-intensive.

PBKDF2: A PROVEN STANDARD

How PBKDF2 Works

PBKDF2 (Password-Based Key Derivation Function 2) is a standardized derivation function that has proven itself over many years. Its operation relies on three key elements:

  1. Underlying hash function: PBKDF2 uses a function like SHA-256 or HMAC to perform repeated cryptographic operations.
  2. Cryptographic salt: A unique random salt is added to the password to prevent the use of precomputed tables (rainbow tables).
  3. Iterations: PBKDF2 applies the hash function thousands or even millions of times, which significantly increases the time needed to test each potential password.

Advantages of PBKDF2 in Sigalion Vault

  • Universal compatibility: As a recognized standard (RFC 2898), PBKDF2 is supported by virtually all platforms and cryptographic libraries.
  • Rigorous validation: Used and tested for decades, its security properties are well understood.
  • Parametric flexibility: The number of iterations can be adjusted according to the evolution of computing power.

ARGON2ID: A ROBUST AND MODERN ALTERNATIVE

Argon2 won the 2015 "Password Hashing Competition," an international competition aimed at creating a new password hashing standard. The Argon2id variant, used in Sigalion Vault, combines the best of the Argon2i approach (resistance to side-channel attacks) and Argon2d (maximum resistance to GPU attacks).

How Argon2id Works

Argon2id is distinguished by three configurable parameters:

  1. Execution time: Similar to PBKDF2 iterations, it defines the duration of the calculation.
  2. Required memory: Argon2id deliberately consumes a significant amount of RAM, making attacks by specialized hardware much more costly.
  3. Parallelism: The number of threads used, optimizing utilization on multi-core processors while maintaining strong resistance to attacks.

Advantages of Argon2id in Sigalion Vault

  • Resistance to hardware attacks: Thanks to its memory requirements, Argon2id makes attacks using GPUs, FPGAs, or ASICs exponentially more expensive.
  • Protection against various attack methods: The "id" variant offers a good balance between security against side-channel attacks and brute force.
  • Adaptability: The parameters can be adjusted to maintain a constant level of security in the face of technological evolution.

WHY USE TWO DERIVATION FUNCTIONS IN SIGALION VAULT?

Sigalion Vault implements both PBKDF2 and Argon2id for several strategic reasons:

  1. Compatibility and migration: PBKDF2 ensures compatibility with existing systems while allowing for a gradual migration to Argon2id.
  2. Defense in depth: Using two different algorithms provides additional protection. If a vulnerability were discovered in one of them, the other would continue to protect your data.
  3. Adaptation to usage contexts: PBKDF2 may be more suitable for devices with limited resources, while Argon2id offers maximum security on systems with sufficient memory.

OPTIMIZATION AND USER EXPERIENCE: A DELICATE BALANCE

The choice and configuration of key derivation functions is not limited solely to robustness against attacks. It is crucial to consider the impact on application performance and, consequently, on the user experience.

Too many iterations in PBKDF2 or memory and execution time parameters that are too large in Argon2id can cause notable delays during authentication. If this delay becomes excessive, it can degrade the user experience and potentially frustrate users.

This is why Sigalion Vault strives to find an optimal balance. The default parameters are chosen to offer a high level of security while ensuring fast authentication for the majority of use cases.

The application is designed to dynamically evolve these parameters over time. This proactive approach allows maintaining an optimal security level in the face of evolving threats and computing capabilities, while ensuring that authentication remains fast and smooth for an optimal user experience.

← Back to articles