Argon2id
Argon2id is a memory-hard password-hashing function and the winner of the 2015 Password Hashing Competition. It combines Argon2d’s resistance to GPU attacks with Argon2i’s resistance to side-channel attacks, and is the current OWASP-recommended default.
How it works
Argon2id fills a large block of memory with a keyed hash chain, then addresses that memory in a partly data-dependent, partly data-independent pattern. Tuning parameters — memory cost (MiB), time cost (iterations), parallelism (threads) — let the deployer target a per-hash cost of tens or hundreds of milliseconds on the intended platform. The memory-hard construction makes GPU and ASIC attacks orders of magnitude more expensive than a comparable time-hard hash such as PBKDF2.
Why it matters
PIN and password derivation must resist brute force at attacker speeds, not defender speeds. An attacker with a modern GPU cluster can try billions of PBKDF2 candidates per second; Argon2id with a 64 MiB memory cost drops that to thousands per second per GPU. For a wallet PIN — which is short and therefore low-entropy — the derivation function is the difference between "unbreakable" and "cracked overnight".
Related concepts
- KEK (Key Encryption Key) — A KEK — Key Encryption Key — is a cryptographic key used to encrypt other keys rather than user data directly.
- AES-256-GCM — AES-256-GCM is Advanced Encryption Standard with a 256-bit key in Galois/Counter Mode.
- iOS Secure Enclave — The Secure Enclave is a dedicated security coprocessor in Apple silicon (A7 and later, all M-series) that generates and stores cryptographic keys in hardware.
- Seed Phrase — A seed phrase — also called a recovery phrase or mnemonic — is a human-readable list of 12 or 24 words that encodes the entropy behind every private key in a wallet.
Frequently asked questions
Why Argon2id and not scrypt or PBKDF2?
Argon2id is the current OWASP recommendation, with better GPU resistance than scrypt at equivalent parameters and much better than PBKDF2.
What happens if I forget my PIN?
Recovery uses your Shamir shards, not a PIN reset. Argon2id cannot be reversed even by Veyrnox.
Are the Argon2id parameters tuned per device?
Yes. Parameters target a fixed on-device time (hundreds of ms) so the security level is consistent across older and newer phones.
In Veyrnox
Veyrnox derives the KEK-unwrap key from the 8-digit PIN with Argon2id parameterised to run in hundreds of milliseconds on-device. The parameters are chosen so an attacker with the ciphertext but no hardware cannot brute-force the PIN faster than real-time device attempts.