Is the default setting for Argon2Function good enough?

[bobaikato]

Curious if the default setting for the Argon2Function is good enough with

Memory (log2) — 15
Iterations — 2
Output Length — 32
Parallelism — 1
Type — Id
Version — 19

[firaja]

These are the minimum suggested requirements by OWASP and it's good: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#introduction

Anything stronger than that is better, but also depends on your system requirements. For example memory=15/iterations=2 and memory=37/iterations=1 provides the same level of security, but there is a tradeoff between RAM and CPU. If you have more computational power than memory you should choose the first one.

In any case Password4j provides a tool that can help to choose the right configuration: https://github.com/Password4j/password4j/wiki/Recommended-settings#responsiveness-3 (numbers here are just random examples)

[bobaikato]

That helped. Thanks, @firaja