> Does this mean that one has to choose between protection against side-channel attacks and protection against GPU cracking? Yes. Argon2i is still resistant against GPU cracking, however with advanced techniques some speedup might be acquired. Argon2d is really GPU unfriendly. The paper explains:
> Should the memory addressing (indexing functions) be input-independent or input-dependent, or hybrid?The first type of schemes, where the memory read location are known in advance, is immediately vulnerable to time-space tradeoff attacks, since an adversary can precompute the missing block by the time it isneeded [5]. In turn, the input-dependent schemes are vulnerable to side-channel attacks [14], as thetiming information allows for much faster password search.
And the recommendation from the paper:
> Argon2 has two variants: Argon2d and Argon2i. Argon2d is faster and uses data-dependingmemory access, which makes it suitable for cryptocurrencies and applications with no threats from side-channeltiming attacks. Argon2i uses data-independent memory access, which is preferred for password hashing andpassword-based key derivation.
