Using the Argon2 Algorithm with `password_hash` in PHP

Argon2, which won the Password Hashing Competition in 2015, is a cryptographic hashing algorithm designed to secure password storage. PHP 7.2 introduced native support for Argon2 in the `password_hash` and `password_verify` functions, improving security over previous algorithms like bcrypt. This article provides a comprehensive guide on implementing Argon2 using the `password_hash` function in PHP.

Understanding Argon2

Argon2 has three variants: Argon2d, Argon2i, and Argon2id.

• Argon2d: Designed to resist GPU cracking attacks by accessing memory in a data-dependent manner.
• Argon2i: Provides protection against side-channel attacks by accessing memory in a data-independent manner.
• Argon2id: A hybrid approach using Argon2i for the first half of the execution and Argon2d for the second half, offering resistance to both GPU and side-channel attacks.

In PHP, Argon2id is used by default when specifying ARGON2 as an option in the `password_hash` function.

Using `password_hash` with Argon2

Syntax

The `password_hash` function creates a new password hash using a secure cryptographic hash algorithm.

• `password`: The user's password.
• `algo`: The algorithm to use. For Argon2, use `PASSWORD_ARGON2I`, `PASSWORD_ARGON2ID`, or simply `PASSWORD_DEFAULT` (in PHP 7.3+).
• `options`: An array defining cost factors such as `memory_cost`, `time_cost`, and `threads`.
• Memory Cost: Defines the amount of memory (in kibibytes) to be used. Higher values make the algorithm more resistant to time-memory trade-off attacks.
• Time Cost: Determines how many iterations of the hash are applied. More iterations increase resistance to brute force but also increase hashing time.
• Threads: Sets the number of parallel threads used for computation. Increasing threads can improve hash computation speed on multicore systems.
• Hardware Capabilities: Adjust `memory_cost`, `time_cost`, and `threads` based on the server's hardware capabilities. Optimal settings ensure robust security, but impractical settings may lead to performance degradation.
• Version Compatibility: Argon2 support requires PHP 7.2 or greater.
• Security Risks: Always use a modern version of PHP to avoid security vulnerabilities associated with older versions of cryptographic libraries.
• Salting: `password_hash` automatically generates a cryptographic salt, so manual salting is not required.
• Peppering: Consider adding a global secret pepper. This is an additional fixed value added to passwords before hashing, stored securely on the server, and never shared.
• Regular Updates: Regularly update your PHP version and library dependencies to remain protected against new vulnerabilities.