PBKDF2 vs Argon2 - which is better?

In short, argon2 is better. Do beware that iOS auto-fill still seems to cause some issues, so if you use iOS, lower your “memory” setting to 48 MiB.

More technical explanation:
Argon2 was specifically crafted to fix the inherent flaws of compute bounded key derivation functions like pbkdf2. With pbkdf2, you can double your iterations, which will double the time you have to wait to unlock your vault, but also double the time an attacker will take to crack your password (if they have your masterpasswordhash). In contrast to this, argon2 is not just compute-bounded but also memory bounded. This means that - for the same unlock time for you - password cracking will be significantly slower for an attacker attempting to crack your password on a GPU or ASIC, because an attacker cannot run as many instances of argon2 in parallel on a GPU, as they could with PBKDF2 due to memory limitations. This means that for the same unlock time for the user, password cracking becomes orders of magnitude slower compared to pbkdf2.

Does one use more resources than the other (and is it even a problem for things like an iPhone)?

Yes, but only during unlocking. And using resources is specifically the point, as using resources is what makes it secure, since an attacker would have to use the same resources to attempt to crack the password. The resources should not be a problem - even on an iPhone or Android phone. The only edge case is iOS autofill, due to a software restriction that is part of iOS. Hence the recommendation to lower the memory to 48 MiB.

2 Likes