what parameters to set

[sidielnikov]

Hi Lucas, please tell me what the approximate value of the parameters in timecost spacecost delta? In terms of calculation speed and security

[samuel-lucas6]

This is difficult to answer because there's no official guidance on the parameters. The default parameters in Rust Crypto (the main implementation) can be found here (the delta is fixed at 3). A delta (δ) of 7 is mentioned in the paper as improving security.

One of the authors of the paper says:

The right way to set the parameters for any of these functions is to set the memory parameter to the largest value that you can tolerate (with the minimal time parameter). Then increase the time parameter to the largest value you can tolerate. Memory is the expensive resource, so this parameter setting will maximize the attacker's cost, subject to whatever resource constraints you (the defender) have.

This is standard password hashing guidance, although it's useful to know some baseline values and generic recommendations. I read something about the parameters being lower than Argon2 somewhere. The efficiency depends on the chosen hash function though, like this would be better with BLAKE2b.

[sidielnikov]

Thanks a lot for your help

[samuel-lucas6]

This paper actually suggests you need more memory/Balloon is less resistant to some attacks than Argon2i due to the smaller block size (Section 6.4).

This paper says Argon2i has higher cumulative memory cost and is more depth-robust than Balloon. However, I've not read these papers properly and wouldn't understand them completely if I tried.

The best shout would probably be asking Steve Thomas to add Balloon to his Minimum Password Settings page.