{"id":51578779,"url":"https://github.com/systemslibrarian/crypto-lab-kdf-arena","last_synced_at":"2026-07-11T03:32:25.618Z","repository":{"id":365580306,"uuid":"1204608952","full_name":"systemslibrarian/crypto-lab-kdf-arena","owner":"systemslibrarian","description":" Browser-based KDF benchmarking — live timing and memory comparison of HKDF, PBKDF2, scrypt, and Argon2id with adjustable cost parameters and bar chart visualization. Part of crypto-lab.","archived":false,"fork":false,"pushed_at":"2026-06-25T10:36:13.000Z","size":66,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-25T12:14:58.759Z","etag":null,"topics":["argon2","bcrypt","browser-demo","crypto-lab","cryptography-education","kdf","key-derivation-function","pbkdf2","scrypt","typescript","vite"],"latest_commit_sha":null,"homepage":"https://systemslibrarian.github.io/crypto-lab-kdf-arena/","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/systemslibrarian.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":"audit/run.mjs","citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-04-08T06:54:17.000Z","updated_at":"2026-06-25T10:36:17.000Z","dependencies_parsed_at":"2026-06-18T02:02:39.393Z","dependency_job_id":null,"html_url":"https://github.com/systemslibrarian/crypto-lab-kdf-arena","commit_stats":null,"previous_names":["systemslibrarian/crypto-lab-kdf-arena"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/systemslibrarian/crypto-lab-kdf-arena","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/systemslibrarian%2Fcrypto-lab-kdf-arena","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/systemslibrarian%2Fcrypto-lab-kdf-arena/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/systemslibrarian%2Fcrypto-lab-kdf-arena/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/systemslibrarian%2Fcrypto-lab-kdf-arena/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/systemslibrarian","download_url":"https://codeload.github.com/systemslibrarian/crypto-lab-kdf-arena/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/systemslibrarian%2Fcrypto-lab-kdf-arena/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35350133,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-11T02:00:05.354Z","response_time":104,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["argon2","bcrypt","browser-demo","crypto-lab","cryptography-education","kdf","key-derivation-function","pbkdf2","scrypt","typescript","vite"],"created_at":"2026-07-11T03:32:25.499Z","updated_at":"2026-07-11T03:32:25.605Z","avatar_url":"https://github.com/systemslibrarian.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# crypto-lab-kdf-arena\n\n## What It Is\n\nKDF Arena is a live, in-browser benchmarking tool that compares four key derivation functions side-by-side: HKDF-SHA256, PBKDF2-SHA256, scrypt, and Argon2id. It measures wall-clock derivation time and estimates memory usage for each function using identical input (password + random 16-byte salt). HKDF is included for educational contrast — it is an extract-and-expand KDF for already-strong key material, not a password-hashing function. The three password KDFs (PBKDF2, scrypt, Argon2id) are compared at their recommended default parameters to illustrate the trade-off between iteration hardness and memory hardness.\n\n## When to Use It\n\n- **Choosing a password KDF for a new system** — run the benchmark on target hardware to see real timing costs before committing to PBKDF2, scrypt, or Argon2id.\n- **Tuning cost parameters** — adjust iterations (PBKDF2), N/r/p (scrypt), or time/memory/parallelism (Argon2id) and observe the impact on derivation time and memory.\n- **Teaching the difference between HKDF and password KDFs** — the sub-millisecond HKDF result makes it visually obvious that HKDF is not designed to resist brute-force attacks on passwords.\n- **Comparing browser WASM performance** — Argon2id runs via `argon2-browser` (compiled to WASM), so results reflect real browser overhead.\n- Do NOT use these results as a server-side benchmark — browser single-threaded WASM performance does not represent native C/Rust implementations on a server.\n\n## Live Demo\n\n**[systemslibrarian.github.io/crypto-lab-kdf-arena](https://systemslibrarian.github.io/crypto-lab-kdf-arena/)**\n\nEnter any password string and click **Run Benchmark** to derive 32-byte keys with all four KDFs using a shared random salt. The results panel shows wall-clock time in milliseconds, estimated memory usage, and a hex preview of each derived key. A horizontal bar chart provides a visual timing comparison.\n\n## What Can Go Wrong\n\n- **PBKDF2 iteration count too low** — using fewer than 600,000 SHA-256 iterations (NIST SP 800-132 2023 guidance) makes offline brute-force feasible on modern GPUs.\n- **scrypt N parameter too small** — if `128 * N * r` fits comfortably in GPU memory, scrypt loses its memory-hardness advantage over PBKDF2.\n- **Argon2id memory set below 64 MB** — reducing the `memory` parameter shrinks the cost asymmetry between defender and attacker; OWASP recommends at least 64 MB for interactive logins.\n- **Using HKDF to hash passwords** — HKDF has no cost parameter and completes in microseconds, offering zero brute-force resistance.\n- **Salt reuse across users** — all four KDFs require a unique random salt per credential; reusing a salt enables precomputation (rainbow-table) attacks.\n\n## Real-World Usage\n\n- **Argon2id** — default password hash in the libsodium `crypto_pwhash` API, adopted by 1Password, Bitwarden, and the PHC (Password Hashing Competition) winner.\n- **scrypt** — used by Tarsnap for key derivation and by Litecoin's proof-of-work algorithm; recommended in RFC 7914.\n- **PBKDF2-SHA256** — required by WPA2 for Wi-Fi key derivation, used in LUKS disk encryption, and specified in NIST SP 800-132.\n- **HKDF-SHA256** — used by TLS 1.3 (RFC 8446) for deriving traffic keys from the handshake secret, and by the Signal Protocol for ratchet key derivation.\n\n## How to Run Locally\n\n```bash\ngit clone https://github.com/systemslibrarian/crypto-lab-kdf-arena\ncd crypto-lab-kdf-arena\nnpm install\nnpm run dev\n```\n\n## Related Demos\n\n- [crypto-lab-kdf-chain](https://systemslibrarian.github.io/crypto-lab-kdf-chain/) — sibling KDF demo with a decision tree, derivation chains, and an attacker-cost model.\n- [crypto-lab-bcrypt-forge](https://systemslibrarian.github.io/crypto-lab-bcrypt-forge/) — bcrypt cost-factor tuning, the other major password-hashing family.\n- [crypto-lab-phantom-vault](https://systemslibrarian.github.io/crypto-lab-phantom-vault/) — PBKDF2-SHA-256 key stretching with HMAC-DRBG in a vault context.\n- [crypto-lab-shadow-vault](https://systemslibrarian.github.io/crypto-lab-shadow-vault/) — Argon2id plus ChaCha20-Poly1305 for file encryption.\n- [crypto-lab-mac-race](https://systemslibrarian.github.io/crypto-lab-mac-race/) — HMAC and other MACs, the PRF underneath these KDFs.\n\n## Accessibility \u0026 Testing\n\nKDF Arena is built to a WCAG 2.1 AA standard and verified by an automated audit\nharness (`audit/run.mjs`) that drives the real page in Chromium:\n\n- **axe-core** (WCAG 2.0/2.1 A + AA) on desktop *and* mobile viewports, in both\n  the initial and post-benchmark states — **0 violations**.\n- **Lighthouse** (mobile form factor) — **100 accessibility, 100 best-practices,\n  100 SEO, 100 performance**.\n- A **screen-reader accessibility-tree check** asserting the heading outline,\n  landmark/region names, labelled controls, the skip link, and the named timing\n  meters.\n\nHighlights: logical heading order, a skip link, a real `\u003cform\u003e` (Enter runs the\nbenchmark), an `aria-live` results region with `aria-busy`, 44px touch targets, a\n16px input floor to prevent iOS zoom, system-preference theme detection,\n`prefers-reduced-motion` support, and AA-compliant contrast in both themes.\n\n```sh\nnpm install\nnpx playwright install chromium   # one-time, for the audit\nnpm run audit                     # build + axe + Lighthouse + SR-tree checks\n```\n\n---\n\n*One of 120+ browser demos in the [Crypto Lab](https://crypto-lab.systemslibrarian.dev/) suite.*\n\n*\"So whether you eat or drink or whatever you do, do it all for the glory of God.\" — 1 Corinthians 10:31*\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsystemslibrarian%2Fcrypto-lab-kdf-arena","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsystemslibrarian%2Fcrypto-lab-kdf-arena","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsystemslibrarian%2Fcrypto-lab-kdf-arena/lists"}