Comparison of Argon2id and Bcrypt with Default Parameters in Performance and Security Aspect for Secure Authentication

Protecting important data, such as password, is just as important as securing a system. Storing important data in a hash form offers better security. This study compares two hashing algorithms, Argon2, specifically Argon2id, and Bcrypt without any parameter modification, and is done directly in Python programming language. By comparing the two algorithms in terms of speed, avalanche effect metric, collision resistance, and memory cost, the trade-off between security and performance could be made. From a performance perspective, Argon2id is superior to Bcrypt in terms of speed (faster processing time) and storage (consume less storage). But Bcrypt has better performance in terms of memory cost, since it uses less memory (less memory cost). From a security perspective though, Argon2id is better in terms of memory cost (consume more memory) and avalanche effect (higher average avalanche metric). On the other hand, Bcrypt wins in terms of security, in output length (since it has longer output) and speed (slower processing time) aspects. In short, Argon2id is better in terms of performance, while both offers good security. This research also provides insight for the developers about the importance of knowing the algorithm that they are using to secure the data, to tune the parameters of the hashing algorithm if possible.