难度大致等于time_cost * memory_cost
(并且可能/ parallelism
)。所以如果你0.25x
的内存成本,你应该4x
时间成本。另请参阅此答案。
// The time parameter specifies the number of passes over the memory and the
// memory parameter specifies the size of the memory in KiB.
查看 Argon2 API 本身。我将稍微交叉引用并使用argon2-cffi 文档。貌似go接口在底层使用了C-FFI(外来函数接口) ,所以protoype应该是一样的。
Parameters
time_cost (int) – Defines the amount of computation realized and therefore the execution time, given in number of iterations.
memory_cost (int) – Defines the memory usage, given in kibibytes.
parallelism (int) – Defines the number of parallel threads (changes the resulting hash value).
hash_len (int) – Length of the hash in bytes.
salt_len (int) – Length of random salt to be generated for each password.
encoding (str) – The Argon2 C library expects bytes. So if hash() or verify() are passed an unicode string, it will be encoded using this encoding.
type (Type) – Argon2 type to use. Only change for interoperability with legacy systems.
事实上,如果我们查看 Go 文档:
// The draft RFC recommends[2] time=1, and memory=64*1024 is a sensible number.
// If using that amount of memory (64 MB) is not possible in some contexts then
// the time parameter can be increased to compensate.
//
// The time parameter specifies the number of passes over the memory and the
// memory parameter specifies the size of the memory in KiB. For example
// memory=64*1024 sets the memory cost to ~64 MB. The number of threads can be
// adjusted to the numbers of available CPUs. The cost parameters should be
// increased as memory latency and CPU parallelism increases. Remember to get a
// good random salt.
我不是 100% 清楚线程数的影响,但我相信它确实并行化了散列,并且像任何多线程作业一样,这减少了大约1/N
N 个内核所花费的总时间。显然,您应该将并行度设置为 cpu count。