from Hacker News

Rust password hashing functions: Argon2, scrypt, PBKDF2

by jph on 6/10/25, 11:33 AM with 4 comments

I'm evaluating Rust password hashing functions, specifically Argon2, scrypt, PBKDF2. I'm using the RustCrypto open source implementations. I have three simple demos in case you want to try these yourself:

* https://github.com/joelparkerhenderson/demo-rust-argon2

* https://github.com/joelparkerhenderson/demo-rust-scrypt

* https://github.com/joelparkerhenderson/demo-rust-pbkdf2

I'm seeking advice please, such as pros and cons. The context is medical software where hashing is on generally modern machines. I'm aware of the OWASP recommendations which seem broadly helpful. Thanks!

  • by cpach on 6/11/25, 10:29 AM

    'tptacek has written about this earlier on HN. See https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

    For comparison, see also the section named Password handling in Cryptographic Right Answers: Post Quantum Edition https://www.latacora.com/blog/2024/07/29/crypto-right-answer...

  • by stop50 on 6/10/25, 2:06 PM

    The first two are good enough, but shouldn't be the only protection. In general salts (adding an per password random string to the raw password) and pepper(addding an random string that is shared across the application) should be added.

    Pbkdf2 is quite old and has an attack vector from ASICs and FPGA, but is still quite widespread for applications and protocols.

  • by dandelion9 on 6/11/25, 8:34 AM

    Of those, scrypt or argon2id. PBKDF2 is for FIPS compliance.

  • by tptacek on 6/12/25, 5:23 AM

    Honestly, throw a dart. I think the right way to think about PBKDF2 vs. Argon2[†] is that Argon2 reaches better levels of security with less cost to "real users" (ie, genuine login attempt latency). It would be a little weird to deliberately select PBKDF2 for a new application today? It would not be among your top 5 security concerns though.

    [†] Really, "PBKDF2 vs. any modern password hash".