I'd draw a line at the post's NIST-adjacent advice.
With the caveat that I may be up to two years out of date here: Last I checked Balloon was a bad choice (only a research implementation) and Argon2 didn't meet the requirements (unapproved primitive in BLAKE2).
With enough rigamarole can you get these into a government office? Probably. But scrypt and yescrypt (the default on most Linux systems) already fit the bill, so just use one of those.
I have a really hard time taking the attack research on password KDFs all that seriously. I don't think there are many common threat models where "weaknesses" in password hashes are more than marginal issues.
Not using a real password KDF is a big issue. Using the wrong one, not so much.
I don't disagree at all. My comment is about paperwork and selling to the government ("operating in the FIPS world", as the post has it, where NIST enters the conversation). I'm sure you can get away with tacking PBKDF2 onto Argon2 here, but those are hoops you don't need to jump through.
Comments
I'd draw a line at the post's NIST-adjacent advice.
With the caveat that I may be up to two years out of date here: Last I checked Balloon was a bad choice (only a research implementation) and Argon2 didn't meet the requirements (unapproved primitive in BLAKE2).
With enough rigamarole can you get these into a government office? Probably. But scrypt and yescrypt (the default on most Linux systems) already fit the bill, so just use one of those.
I have a really hard time taking the attack research on password KDFs all that seriously. I don't think there are many common threat models where "weaknesses" in password hashes are more than marginal issues.
Not using a real password KDF is a big issue. Using the wrong one, not so much.
I don't disagree at all. My comment is about paperwork and selling to the government ("operating in the FIPS world", as the post has it, where NIST enters the conversation). I'm sure you can get away with tacking PBKDF2 onto Argon2 here, but those are hoops you don't need to jump through.