Evaluation of Password Hashing Competition Finalists: Performance, Security, Compliance Mapping, and Post-Quantum Readiness

Year 2025, Volume: 8 Issue: 6, 1841 - 1855, 15.11.2025

Erdem Ulutas , Baris Celiktas

https://doi.org/10.34248/bsengineering.1670109

Abstract

Password hashes and key derivation functions (KDFs) are central to authentication and cryptographic security schemes crafted to defend user credentials from brute-force attacks and unauthorized access. Password hashing algorithms, for example PBKDF2, bcrypt, or scrypt, are very popular today, but are lacking in the face of modern hardware acceleration, parallel processing, and advanced cryptanalytic attacks. To contest these shortcomings, the Password Hashing Competition (PHC) was started in 2013 and had 22 candidates for functions for hashing passwords. After thorough evaluation, 9 finalists were selected based on how secure, fast, memory-friendly, flexible, and efficient these functions were. This study evaluates the nine PHC finalists—Argon2, battcrypt, Catena, Lyra2, MAKWA, Parallel, POMELO, Pufferfish, and yescrypt—through survey findings and performance benchmarks. We have evaluated these functions from an architectural standpoint and studied their security features, memory hardness, performance trade-off, and practical usage. We also compare these finalists with traditional password hashing functions to highlight their advantages and limitations. We also investigate the post-quantum assumption for password hashing – the effectiveness of these functions against quantum assaults, their position in a new cryptography set, and the role of peppering as an additional security measure. In addition, we perform a comprehensive compliance mapping of the PHC finalists against major global standards and regulations such as NIST SP 800-63B, OWASP ASVS, PCI DSS, GDPR, KVKK, and ISO/IEC 27001, highlighting their practical suitability for secure deployment in regulated environments. Finally, we provide usage recommendations for these functions for web authentication, KDFs, and embedded platforms. This paper serves as a reference for researchers, developers, and security engineers, while also introducing a compliance-aware, post-quantum-ready framework that bridges cryptographic design with regulatory and deployment needs.

Keywords

Password hashing , Key derivation , Security , Performance , Quantum resistance , Compliance

Ethical Statement

Ethics committee approval was not required for this study because there was no study on animals or humans.

References

• Álvarez R, Zamora A. 2017. Using spritz as a password-based key derivation function. In: Int Joint Conf SOCO’16-CISIS’16-ICEUTE’16: San Sebastián, Spain, October 19th-21st, 2016 Proceedings 11, pp: 518-525.
• Alwen J, Gazi P, Kamath C, Klein K, Osang G, Pietrzak K, Rybár M. 2018. On the memory-hardness of data-independent password-hashing functions. In: Proceedings of the 2018 on Asia Conf Comp Commun Secur, pp: 51-65.
• Andrade ER, Simplicio MA, Barreto PS, dos Santos PC. 2016. Lyra2: Efficient password hashing with high security against time-memory trade-offs. IEEE Trans Comput, 65(10): 3096-3108.
• Anonymous. 2025. PHC string format. URL: https://github.com/P-H-C/phc-string-format/blob/master/phc-sf-spec.md (accessed date: April 1, 2025).
• Aumasson JP. 2013. Password hashing: the future is now, Kudelski Security, Switzerland, pp: 1-10.
• Backendal M, Clermont S, Fischlin M, Günther F. 2025. Key derivation functions without a grain of salt. In Annual Int Conf Theory Appl Cryptogr Tech, pp: 393-426.
• Bellovin SM, Merritt M. 1993. Augmented encrypted key exchange: A password-based protocol secure against dictionary attacks and password file compromise. In: Proc of the 1st ACM Conf Computer Commun Secur, pp: 244-250.
• Blocki J, Harsha B, Zhou S. 2018. On the economics of offline password cracking. In: 2018 IEEE Symp Secur Privacy (SP), pp: 853-871.
• Blocki J, Sridhar A. 2016. Client-cash: Protecting master passwords against offline attacks. In: Proceedings of the 11th ACM on Asia Conf Comp Commun Secur, pp: 165-176.
• CCPA. 2018. California Consumer Privacy Act (CCPA). URL: https://oag.ca.gov/privacy/ccpa (accessed date: March 04, 2025).
• Choe J, Moreshet T, Bahar RI, Herlihy M. 2019. Attacking memory-hard scrypt with near-data-processing. In: Proc Int Symp Mem Syst, pp: 33-37.
• Clark M, Seamons K. 2022. Passwords and cryptwords: the final limits on lengths. In: Proc 2022 New Secur Paradigms Workshop, pp: 75-89.
• Forler C, List E, Lucks S, Wenzel J. 2015. Overview of the candidates for the password hashing competition: And their resistance against garbage-collector attacks. In: Technology and Practice of Passwords: Int Conf Passwords, Passwords'14, Trondheim, Norway, December 8-10, 2014, Revised Selected Papers 7, pp: 3-18.
• Forler C, Lucks S, Wenzel J. 2013. Catena: A memory-consuming password-scrambling framework. Cryptology ePrint Arch, pp: 31.
• GDPR. 2016. General Data Protection Regulation (GDPR). URL: https://gdpr-info.eu/ (accessed date: March 04, 2025).
• Gosney J. 2015. Pufferfish2 password hashing scheme. URL: https://github.com/epixoip/pufferfish (accessed date: April 04, 2025).
• Grassi PA, Fenton JL, Newton EM, Perlner RA, Regenscheid AR, Burr WE, Richer JP, Lefkovitz NB, Danker JM, Choong YY, Greene KK, Theofanos MF. 2023. Nist special publication 800-63b digital identity guidelines. Natl Inst Stand Tech (NIST), pp: 27.
• Grover LK. 1996. A fast quantum mechanical algorithm for database search. In Proc twenty-eighth annu ACM symp Theory comp, pp: 212-219.
• Hatzivasilis G, Papaefstathiou I, Manifavas C. 2015. Password hashing competition-survey and benchmark. Cryptology ePrint Archive, pp: 30.
• Hatzivasilis G. 2017. Password-hashing status. Cryptography, 1(2): 10.
• ISO/IEC 27001: 2022. 2022. Information security, cybersecurity and privacy protection — Information security management systems — Requirements. URL: https://www.iso.org/standard/27001 (accessed date: March 04, 2025).
• Kodwani G, Arora S, Atrey PK. 2021. On security of key derivation functions in password-based cryptography. In: 2021 IEEE Inter Conf Cyber Secur Resilience (CSR), pp: 109-114.
• KVKK. 2016. Personal Data Protection Law (KVKK). URL: https://www.mevzuat.gov.tr/mevzuat?MevzuatNo=6698&MevzuatTur=1&MevzuatTertip=5 (accessed date: March 04, 2025).
• Lata K, Bansal A. 2021. Timing side-channel attack resistant key derivation functions for cryptosystems. In: 2021 IEEE Int Symp Smart Electron Syst (iSES), pp: 395-399.
• LGPD. 2018. General Personal Data Protection Law (LGPD). URL: https://iapp.org/media/pdf/resource_center/Brazilian_General_Data_Protection_Law.pdf (accessed date: March 04, 2025).
• Lu YF, Kuo CF, Fang YY. 2016. Efficient storage encryption for android mobile devices. In: Proc Int Conf Res Adapt Convergent Syst, pp: 213-218.
• Luo Y, Su Z, Zheng W, Chen Z, Wang F, Zhang Z, Chen J. 2021. A novel memory-hard password hashing scheme for blockchain-based cyber-physical systems. ACM Trans Internet Technol, 21(2): 1-21.
• Mcginthy JM, Michaels AJ. 2019. Further analysis of PRNG-based key derivation functions. IEEE Access, 7: 95978-95986.
• Moore GE. 1965. Moore’s law. Electron Mag, 38(8): 114.
• OWASP ASVS. 2021. Open worldwide application security project application security verification standard (OWASP ASVS) v4.0.3. URL: https://github.com/OWASP/ASVS/blob/master/4.0/en/0x11-V2 Authentication.md (accessed date: March 04, 2025).
• OWASP ASVS. 2025. Open worldwide application security project application security verification standard (OWASP ASVS) v5.0. URL: https://github.com/OWASP/ASVS/blob/master/5.0/en/0x97-Appendix-V_Cryptography.md (accessed date: March 04, 2025).
• OWASP Password Storage Cheat Sheet. 2025. URL: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#upgrading-the-work-factor (accessed date: March 23, 2025).
• PCI Security Standards Council. 2024. Data security standard. Requir Secur Assess version, 4.0.1. URL: https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v4_0_1.pdf (accessed date: March 04, 2025).
• Peslyak A. 2015. yescrypt - a password hashing competition submission. URL: https://www.password-hashing.net/submissions/specs/yescrypt-v2.pdf (accessed date: April 04, 2025).
• PIPEDA. 2000. Personal information protection and electronic documents act. Department of Justice (PIPEDA). URL: http://laws-lois.justice.gc.ca/PDF/P-8.6.pdf (accessed date: March 04, 2025).
• PIPL. 2021. Personal information protection law of the people's republic of China (PIPL). URL: http://en.npc.gov.cn.cdurl.cn/2021-12/29/c_694559.htm (accessed date: March 04, 2025).
• Pornin T. 2015. The MAKWA password hashing function specifications v1.1. URL: https://www.bolet.org/makwa/makwa-spec-20150422.pdf (accessed date: April 04, 2025).
• Provos N, Mazieres D. 1999. A future-adaptable password scheme. In: USENIX annual technical conference, FREENIX track, Vol. 1999, pp: 81-91.
• RFC 6070. 2011. PKCS #5: Password-based key derivation function 2 (PBKDF2) test vectors. URL: https://www.rfc-editor.org/info/rfc6070 (accessed date: April 2, 2025).
• RFC 9106. 2021. Argon2 Memory-hard function for password hashing and proof-of-work applications. URL: https://www.rfc-editor.org/info/rfc9106 (accessed date: March 20, 2025).
• Saad MIM, Jalil KA, Manaf M. 2016. Secured authentication using anonymity and password-based key derivation function. In: Mobile Web Intell Inf Syst: 13th Intern Conf, MobiWIS 2016, Vienna, Austria, August 22-24, 2016, Proceedings 13, pp: 184-197.
• Shen Y, Wang L, Gu D. 2025. Security analysis of nist key derivation using pseudorandom functions. Cryptology ePrint Archive, pp: 38.
• Shor PW. 1994. Algorithms for quantum computation: discrete logarithms and factoring. In Proc 35th annual symp found comp sci, pp: 124-134.
• Simplicio Jr MA, Almeida LC, Andrade ER, dos Santos PC, Barreto PS. 2014. The Lyra2 reference guide. Tech Report v2. 3.2.
• Thomas S. 2014. Battcrypt. URL: https://www.password-hashing.net/submissions/specs/battcrypt-v0.pdf (accessed date: April 04, 2025).
• Thomas S. 2015. Parallel. URL: https://www.password-hashing.net/submissions/specs/Parallel-v1.pdf (accessed date: April 04, 2025).
• Tran DN, Nguyen Tien X, Nguyen Xuan T, Le Viet P. 2024. A user-centric key management for cloud encryption using key derivation function. in: The Intern Conf Intell Syst Networks, pp: 479-487.
• Wang M, Duan M, Zhu J. 2018. Research on the security criteria of hash functions in the blockchain. In: Proc 2nd ACM Workshop on Blockchains, Cryptocurrencies, Contracts, pp: 47-55.
• Wetzels J. 2016. Open sesame: The password hashing competition and Argon2. arXiv preprint arXiv:1602.03097.
• Wu H. 2015. POMELO a password hashing algorithm (Version 2). URL: https://www.password-hashing.net/submissions/specs/POMELO-v3.pdf (accessed date: April 04, 2025).
• Yao FF, Yin YL. 2005. Design and analysis of password-based key derivation functions. In: Topics in Cryptology–CT-RSA 2005: The Cryptographers’ Track at the RSA Conf 2005, San Francisco, CA, USA, February 14-18, 2005. Proceedings, pp: 245-261.