[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-571776-105":53,"doc-detail-571776-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","evaluating-argon2-adoption-and-effectiveness-in-real-world-software-abstract","Evaluating Argon2 Adoption and Effectiveness in Real-World Software - Abstract","","Modern password hashing is a crucial defense against credential cracking, but moving from theoretically secure algorithms to reliable real-world deployments introduces major pitfalls. This paper analyzes Argon2 through attack simulations measuring how parameter choices affect guessing costs under realistic budgets and a large-scale empirical study of Argon2 usage across public GitHub repositories. An economic model validated with cryptocurrency mining benchmarks shows that OWASP’s 46 MiB configuration lowers compromise rates by 42.5% versus SHA-256 at $1/account budgets for strong passwords, yet memory-hardness yields limited extra protection at higher RAM. Weak passwords still produce high compromise rates regardless of algorithm, and many deployments use weaker-than-recommended parameters, with sensitive applications not necessarily configured more securely.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":11,"@type":70,"position":76},"https://docshare.wps.com/template/presentations/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/evaluating-argon2-adoption-and-effectiveness-in-real-world-software-abstract/571776/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/evaluating-argon2-adoption-and-effectiveness-in-real-world-software-abstract/571776.png","ImageObject",442,249,{"name":88,"@type":89},"OmBimo","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-19","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":47},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"What is the main focus of the paper on Argon2 adoption?","Question",{"text":108,"@type":109},"The paper evaluates Argon2’s effectiveness in real-world software by combining attack simulations with a large-scale empirical study of adoption across public GitHub repositories.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"How does the OWASP-recommended Argon2 configuration compare with SHA-256?",{"text":113,"@type":109},"The model shows OWASP’s 46 MiB configuration reduces compromise rates by 42.5% versus SHA-256 for strong passwords under $1/account attack budgets.",{"name":115,"@type":106,"acceptedAnswer":116},"Do stronger memory-hard settings always provide proportionally better protection?",{"text":117,"@type":109},"No. Increasing memory to 2048 MiB (RFC 9106) provides limited additional protection despite much higher memory demands, indicating diminishing returns.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},571776,1792148299,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":47,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":135,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":141},962090893581,"https://ap-avatar.wpscdn.com/davatar_276721f389ce27ea32af1340a28f341c","arXiv :2504 . 17121v2 [ cs .CR] 30 Oct 2025  \nEvaluating Argon2 Adoption and Effectiveness in Real-World Software  \nPascal Tippe 1 ⋆ and Michael P. Berner 1  \nFernUniversität in Hagen  \nHagen, Germany  \nAbstract. Modern password hashing remains a critical defense against credential cracking, yet the transition from theoretically secure algorithms to robust real-world implementations remains fraught with challenges. This paper presents a dual analysis of Argon2, the Password Hashing Competition winner, combining attack simulations quantifying how parameter configurations impact guessing costs under realistic budgets, with the first large-scale empirical study of Argon2 adoption across public GitHub software repositories. Our economic model, validated against cryptocurrency mining benchmarks, demonstrates that OWASP’s recommended 46 MiB configuration reduces compromise rates by 42.5% compared to SHA-256 at $1/account attack budgets for strong user passwords. However, memory-hardness exhibits diminishing returns as increasing allocations to RFC 9106’s 2048 MiB provides just 23.3%($1) and 17.7%($20) additional protection despite 44.5 ×greater memory demands. Crucially, both configurations fail to mitigate risks from weak passwords, with 96 .9-99.8% compromise rates for RockYou-like credentials regardless of algorithm choice. Our repository analysis shows accelerating Argon2 adoption, yet weak configuration practices: 46.6% of deployments use weaker-than-OWASP parameters. Surprisingly, sensitive applications (password managers, encryption tools) show no stronger configurations than general software. Our findings highlight that a secure algorithm alone cannot ensure security, effective parameter guidance and developer education remain essential for realizing Argon2’s theoretical advantages.  \nKeywords: password hashing · Argon2 · cryptographic adoption  \n1 Introduction  \nAs reliance on digital systems continues to grow, ensuring secure user authentication has become a critical challenge in cybersecurity. Password hashing functions play a pivotal role in protecting credentials, yet legacy algorithms like SHA-256 exhibit persistent vulnerabilities when deployed in authentication systems. Despite their theoretical security properties, these algorithms are increasingly ineffective against modern attacks that leverage GPU and ASIC-based  \n⋆ [Corresponding author: firstname.lastname@fernuni-hagen.de](Corresponding author: firstname.lastname@fernuni-hagen.de)  \n2 Pascal Tippe and Michael P. Berner  \nhardware to test billions of password candidates per second. This gap between theoretical robustness and practical resilience underscores the need for more advanced cryptographic solutions. Argon2, the winner of the 2015 Password Hashing Competition, represents a significant advancement in password hashing design by introducing memory-hardness that increases computational costs for attackers using specialized cracking hardware [2] . By requiring substantial RAM allocation during hash computation (configurable via parameters), Argon2 creates asymmetric costs that favor defenders over attackers. However, its effectiveness depends heavily on parameter selection, with configurations such asthe OWASP-recommended 46 MiB memory differing significantly from the RFC 9106 proposal of 2 GiB memory. This disparity highlights the importance of standardized, context-aware parameterization frameworks that balance security and performance. While Argon2’s theoretical advantages are well-documented in academic literature, its adoption in real-world software remains inconsistent. Our preliminary repository scans suggest a persistent reliance on older algorithms like SHA-256 and PBKDF2, particularly in legacy systems where backward compatibility concerns often outweigh security considerations. Even when Argon2 is implemented, suboptimal parameter configurations are common, reflecting systemic barriers to cryptographic modernization. This study addresses four key q","cbCaiuiB4sJjBxCo","https://ap.wps.com/l/cbCaiuiB4sJjBxCo","pdf",586305,22,"English","# 1 Introduction\n# 2 Background and Related Work\n## Online breach impact\n## Attacker strategies and salt","[{\"question\":\"What is the main focus of the paper on Argon2 adoption?\",\"answer\":\"The paper evaluates Argon2’s effectiveness in real-world software by combining attack simulations with a large-scale empirical study of adoption across public GitHub repositories.\"},{\"question\":\"How does the OWASP-recommended Argon2 configuration compare with SHA-256?\",\"answer\":\"The model shows OWASP’s 46 MiB configuration reduces compromise rates by 42.5% versus SHA-256 for strong passwords under $1/account attack budgets.\"},{\"question\":\"Do stronger memory-hard settings always provide proportionally better protection?\",\"answer\":\"No. Increasing memory to 2048 MiB (RFC 9106) provides limited additional protection despite much higher memory demands, indicating diminishing returns.\"}]","Evaluating Argon2 Adoption and Effectiveness in Real-World Software - Abstract | PDF",1791923682,8]