What is the recommended number of iterations for Argon2? I've recompiled my operating system ("LionBSD" based on FreeBSD) to use Argon2i as the default password hashing algorithm in crypt/libcrypt.

I'm wondering what the recommended number of iterations would be?

As an example, OpenBSD uses 8 iterations of bcrypt by default.
I'm wondering what the recommended number of iterations would be?


Unlike bcrypt or traditional crypt, argon2 does not have a single iteration count, but three parameters affecting the computational cost:


Number of iterations $t$, affecting the time cost.
Size of memory used $m$, affecting the memory cost.
Number of threads $h$, affecting the degree of parallelism.


In addition there are two versions of argon2: argon2d uses data-dependent accesses for presumably stronger tradeoff resistance, while argon2i eschews them to avoid side channel attacks. The latter is recommended for password-hashing.

The argon2 paper gives the following procedure (paraphrased) for determining the parameters you should use:


Figure out how many threads you can use, choose $h$ accordingly.
Figure out how much memory you can use, choose $m$ accordingly.
Decide on the maximum time $x$ you can spend on it, choose the largest $t$ such that it takes less than $x$ with your system and other parameter choices.


I.e. they recommend you run it on your system and decide the largest parameters that match your limits on memory and processor time use.