m=47104 (46 MiB), t=1, p=1 (Do not use with Argon2i)
m=19456 (19 MiB), t=2, p=1 (Do not use with Argon2i)
m=12288 (12 MiB), t=3, p=1
m=9216 (9 MiB), t=4, p=1
m=7168 (7 MiB), t=5, p=1
These configuration settings provide an equal level of defense, and the only difference is a trade off between CPU and RAM usage.
But when I did a microbenchmark, I did not see such a tradeoff. OWASP5 uses less memory, and also computes faster, despite only using one core. So it cannot be security-equivalent to owasp2?
Did I misunderstand something?
sample hashes:
owasp1: $argon2id$v=19$m=47104,t=1,p=1$cmFuZG9tc2FsdA$iHnO3PV8thkDFtOrfZoTAbRnXDFRBlPBjUDH2YZOFg0
owasp2: $argon2id$v=19$m=19456,t=2,p=1$cmFuZG9tc2FsdA$iPyfxk/AZLDJm99lymi9IxCu/TFIRq/2hX8/EnkkOgc
owasp5: $argon2id$v=19$m=7168,t=5,p=1$cmFuZG9tc2FsdA$pQG85lqVEbrzBlBJi72wrJtfhHd3l+/8CykzYxQaNxU
microbenchmark:
argon2 hash owasp1 time: [35.929 ms 36.155 ms 36.384 ms]
argon2 hash owasp2 time: [20.333 ms 20.432 ms 20.533 ms]
argon2 hash owasp5 time: [17.208 ms 17.322 ms 17.477 ms]
According to OWASP, these are equivalent:
But when I did a microbenchmark, I did not see such a tradeoff. OWASP5 uses less memory, and also computes faster, despite only using one core. So it cannot be security-equivalent to owasp2?
Did I misunderstand something?