Argon2id password hashing neutralizes GPU advantage in cracking attempts

The Argon2id password hashing algorithm significantly increases the cost of offline password cracking by mitigating the advantage offered by modern GPUs, according to a recent report by Cyber Insider.

A study by Specops researcher David Ketler examined Argon2id's performance against current password-cracking hardware, specifically testing an eight-GPU system with Nvidia RTX 5090 cards and a single AMD EPYC 9B14 server processor. The results indicated minimal performance difference between the two platforms when hashing Argon2id, a stark contrast to older algorithms like SHA-256 where GPUs offer substantial speedups.

The study found Argon2id to be approximately 451 million times slower than SHA-256 on the tested hardware. For instance, an eight-character password with mixed case letters would take an estimated 3,457 years to crack with Argon2id, compared to just 4 minutes with SHA-256. However, Specops cautions that this does not eliminate password cracking risks, as attackers often use methods like credential stuffing, phishing, and exploiting previous data breaches, bypassing the hashing process entirely.

Source: Cyber Insider