Intermediate LevelAuthentication & Authorization
How do you tune Argon2id parameters (memory cost m, time cost t, parallelism p)?
❓ Interview Prompt: Explain Argon2id parameter optimization, memory cost (m), time iterations (t), parallelism (p), and hardware defense.
Argon2id (the OWASP recommended password hashing function) provides 3 configurable parameters to tune hashing performance and security:
Argon2id Parameters:
1
Memory Cost ('m'): Amount of RAM (in KiB) consumed per hash computation (e.g. '65536 KiB = 64 MB'). High memory cost prevents hardware attackers from building custom ASIC/GPU mining rigs!
2
Time Cost ('t'): Number of execution iterations/passes over memory (e.g. 't = 3').
3
Parallelism ('p'): Number of compute threads used in parallel (e.g. 'p = 4').
OWASP Tuning Rule of Thumb:
Target a calculation execution time of ~500 milliseconds per password hash on production servers.
Code Implementation Example
typescript
import argon2 from 'argon2';
// OWASP Recommended Argon2id Benchmark Configuration
const OWASP_ARGON2_CONFIG = {
type: argon2.argon2id,
memoryCost: 65536, // 64 MB RAM
timeCost: 3, // 3 Iterations
parallelism: 4 // 4 Parallel Threads
};
async function benchmarkArgon2() {
const start = Date.now();
await argon2.hash('SuperSecretPassword123!', OWASP_ARGON2_CONFIG);
console.log("Argon2id Hash Duration: " + (Date.now() - start) + " ms");
}💡Configuring OWASP recommended Argon2id parameters.
🎯 Interview Key Takeaway
Tune Argon2id memory cost (64MB) and time cost to target ~500ms execution time, blocking GPU hardware brute-force.
#Argon2id#Password Hashing#OWASP#Performance#Intermediate
Back to all Authentication & Authorization Questions→