&gt; Does this mean that one has to choose between protection against side-channel attacks and protection against GPU cracking?<p>Yes. Argon2i is still resistant against GPU cracking, however with advanced techniques some speedup might be acquired. Argon2d is really GPU unfriendly. The paper explains:<p>&gt; Should the memory addressing (indexing functions) be input-independent or input-dependent, or hybrid?
The first type of schemes, where the memory read location are known in advance, is immediately vulnerable to time-space tradeoff attacks, since an adversary can precompute the missing block by the time it is
needed [5]. In turn, the input-dependent schemes are vulnerable to side-channel attacks [14], as the
timing information allows for much faster password search.<p>And the recommendation from the paper:<p>&gt; Argon2 has two variants: Argon2d and Argon2i. Argon2d is faster and uses data-depending
memory access, which makes it suitable for cryptocurrencies and applications with no threats from side-channel
timing attacks. Argon2i uses data-independent memory access, which is preferred for password hashing and
password-based key derivation.