Argon2Parameters (Bouncy Castle Library 1.85 API Specification)
Date: 2026-07-12

org.bouncycastle.crypto.params

## Class Argon2Parameters

- java.lang.Object
- - org.bouncycastle.crypto.params.Argon2Parameters

-     public class Argon2Parameters
      extends java.lang.Object

  Configuration parameters for the `Argon2 PBKDF`.

  Build instances with `Argon2Parameters.Builder`, e.g.

       Argon2Parameters params = new Argon2Parameters.Builder(Argon2Parameters.ARGON2_id)
           .withVersion(Argon2Parameters.ARGON2_VERSION_13)
           .withSalt(salt)
           .withIterations(3)
           .withMemoryPowOfTwo(16)
           .withParallelism(4)
           .build();

- - ### Nested Class Summary

    Nested Classes
    Modifier and Type | Class and Description
    --- | ---
    `static class` | `Argon2Parameters.Builder` Fluent builder for `Argon2Parameters`.

  - ### Field Summary

    Fields
    Modifier and Type | Field and Description
    --- | ---
    `static int` | `ARGON2_d` Argon2d - data-dependent memory access.
    `static int` | `ARGON2_i` Argon2i - data-independent memory access.
    `static int` | `ARGON2_id` Argon2id - hybrid of `ARGON2_i` and `ARGON2_d`.
    `static int` | `ARGON2_VERSION_10` Argon2 v1.0 (legacy).
    `static int` | `ARGON2_VERSION_13` Argon2 v1.3 - the version standardised by RFC 9106.
    `static java.lang.String` | `MAX_MEMORY_EXP` System/security property setting the maximum permitted memory exponent (i.e.
    `static java.lang.String` | `MAX_PARALLELISM` System/security property bounding the Argon2 parallelism (lanes) accepted when a key is derived from untrusted cost parameters - notably an OpenPGP Argon2 S2K specifier.
    `static java.lang.String` | `MAX_PASSES` System/security property bounding the number of Argon2 passes (iterations) accepted when a key is derived from untrusted cost parameters - notably an OpenPGP Argon2 S2K specifier.

  - ### Method Summary

    All Methods Instance Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `void` | `clear()` Zeroise sensitive state (salt, secret, additional) held by these parameters.
    `byte[]` | `getAdditional()`
    `Argon2BytesGenerator.BlockPool` | `getBlockPool()`
    `CharToByteConverter` | `getCharToByteConverter()`
    `int` | `getIterations()`
    `int` | `getLanes()`
    `int` | `getMemory()`
    `byte[]` | `getSalt()`
    `byte[]` | `getSecret()`
    `int` | `getType()`
    `int` | `getVersion()`

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Field Detail

    - #### MAX_MEMORY_EXP

          public static final java.lang.String MAX_MEMORY_EXP

      System/security property setting the maximum permitted memory exponent (i.e. `memory <= 1 << MAX_MEMORY_EXP`). Defaults to 24 (16 GiB); the property may be raised up to a ceiling of 30. The default was lowered from the historical 30 (1 TiB) so that a single key derivation driven by attacker-chosen cost parameters - notably an OpenPGP Argon2 S2K specifier read from an unauthenticated packet - cannot exhaust the heap of a typical host.
      See Also:
        Constant Field Values

    - #### MAX_PASSES

          public static final java.lang.String MAX_PASSES

      System/security property bounding the number of Argon2 passes (iterations) accepted when a key is derived from untrusted cost parameters - notably an OpenPGP Argon2 S2K specifier. Defaults to 10; OpenPGP key derivation rejects a larger value rather than spend unbounded CPU on attacker-chosen iterations. Read via `Properties.asInteger(java.lang.String, int)`.
      See Also:
        Constant Field Values

    - #### MAX_PARALLELISM

          public static final java.lang.String MAX_PARALLELISM

      System/security property bounding the Argon2 parallelism (lanes) accepted when a key is derived from untrusted cost parameters - notably an OpenPGP Argon2 S2K specifier. Defaults to 16. Read via `Properties.asInteger(java.lang.String, int)`.
      See Also:
        Constant Field Values

    - #### ARGON2_d

          public static final int ARGON2_d

      Argon2d - data-dependent memory access.
      See Also:
        Constant Field Values

    - #### ARGON2_i

          public static final int ARGON2_i

      Argon2i - data-independent memory access.
      See Also:
        Constant Field Values

    - #### ARGON2_id

          public static final int ARGON2_id

      Argon2id - hybrid of `ARGON2_i` and `ARGON2_d`.
      See Also:
        Constant Field Values

    - #### ARGON2_VERSION_10

          public static final int ARGON2_VERSION_10

      Argon2 v1.0 (legacy).
      See Also:
        Constant Field Values

    - #### ARGON2_VERSION_13

          public static final int ARGON2_VERSION_13

      Argon2 v1.3 - the version standardised by RFC 9106.
      See Also:
        Constant Field Values

  - ### Method Detail

    - #### getSalt

          public byte[] getSalt()

      Returns:
        a defensive copy of the salt, or null if none was set.

    - #### getSecret

          public byte[] getSecret()

      Returns:
        a defensive copy of the secret value, or null if none was set.

    - #### getAdditional

          public byte[] getAdditional()

      Returns:
        a defensive copy of the additional data, or null if none was set.

    - #### getIterations

          public int getIterations()

      Returns:
        the number of passes (time cost).

    - #### getMemory

          public int getMemory()

      Returns:
        the memory cost in KiB.

    - #### getLanes

          public int getLanes()

      Returns:
        the parallelism (lane count).

    - #### getVersion

          public int getVersion()

      Returns:
        the Argon2 version constant (`ARGON2_VERSION_10` or `ARGON2_VERSION_13`).

    - #### getType

          public int getType()

      Returns:
        the Argon2 variant constant (`ARGON2_d`, `ARGON2_i`, or `ARGON2_id`).

    - #### getCharToByteConverter

          public CharToByteConverter getCharToByteConverter()

      Returns:
        the character-to-byte converter used to encode `char[]` passwords.

    - #### getBlockPool

          public Argon2BytesGenerator.BlockPool getBlockPool()

      Returns:
        the user-supplied `Argon2BytesGenerator.BlockPool`, or null if the generator should use its default per-call pool.

    - #### clear

          public void clear()

      Zeroise sensitive state (salt, secret, additional) held by these parameters.