Slow functions: bcrypt, scrypt, Argon2

The salt neutralizes precomputed tables, but not brute force on a targeted account. The countermeasure: make each attempt deliberately slow.

Turning speed against the attacker

The idea is counterintuitive. SHA-256 is a problem because it is fast: billions of attempts per second. The solution is therefore to use deliberately slow and expensive functions.

These functions are called key derivation functions (KDF). The best known for passwords are bcrypt, scrypt, and Argon2. They do not merely hash once: they repeat the operation thousands of times, or consume a lot of memory.

The work factor

These functions have an adjustable work factor (cost factor). It sets how expensive the operation is: the higher it is, the longer each hash computation takes.

bcrypt, factor 10  -> ~0.1 s per hash
bcrypt, factor 12  -> ~0.4 s per hash
bcrypt, factor 14  -> ~1.6 s per hash

We raise it over the years, as hardware advances, without changing any code.

Why slowness defends

Let's compare from both sides, with a target of ~0.1 s per attempt.

                       SHA-256 (fast)     bcrypt (slow, 0.1 s)
Legitimate user     :  imperceptible      imperceptible (once)
Attacker (mass)     :  ~1,000,000,000/s   ~10 attempts/s

For the legitimate user, 0.1 s at login is imperceptible: they only log in once. For the attacker, who must test billions of candidates, going from a billion to a few dozen attempts per second makes mass brute force impractical — centuries instead of minutes.

Slowness bothers no one useful and ruins the attacker: it is a quality, not a flaw.

Argon2 and memory resistance

Attackers use GPUs and dedicated chips (ASICs) that massively parallelize computations. To counter this, modern functions are memory-hard: they require a lot of memory per attempt.

Argon2, winner of an international competition and recommended today, is designed this way. Memory is expensive to multiply on a GPU/ASIC: requiring, say, several tens of megabytes per attempt breaks the advantage of hardware parallelism.

Comparison table

Function	Speed	Work factor	Memory resistance	Use
SHA-256	Very fast	No	No	Integrity, not passwords
bcrypt	Slow, tunable	Yes (cost)	Low	Passwords (proven)
scrypt	Slow, tunable	Yes	Yes	Passwords
Argon2	Slow, tunable	Yes	Yes (memory-hard)	Passwords (recommended)

In summary

• Against brute force, we use deliberately slow functions: bcrypt, scrypt, Argon2.
• Their work factor is adjustable and increased over time.
• Slowing each attempt (e.g. 0.1 s) makes mass brute force impractical without bothering the legitimate user.
• Argon2 is memory-hard: it resists GPU/ASIC attacks by requiring a lot of memory.