Comparative analysis of password hashingcompetition finalists: security, efficiency,compliance, and future trends in key derivation

The application of password hashes and key derivation functions (KDFs) is core to authentication and cryptographic security schemes crafted to defend user credentials from brute-force attacks and unauthorized access. Password hashing algorithms, for example PBKDF2, bcrypt, or scrypt, are very popular today, but are lacking in the face of modern hardware acceleration, parallel processing, and advanced cryptanalytic attacks. To contest these shortcomings, the Password Hashing Competition (PHC) was started in 2013 and had 22 candidates for functions for hashing passwords. After thorough evaluation, 9 finalists were selected based on how secure, fast, memory-friendly, flexible, and efficient these functions were. This study discusses the survey and benchmark studies of the PHC finalists: Argon, battcrypt, Catena, Lyra2, MAKWA, Parallel, POMELO, Pufferfish, and yescrypt. We have evaluated these functions from an architectural standpoint and studied their security features, memory hardness, performance trade-off, and practical usage. These functions also need to be compared with traditional password hashing functions, and this was done to evaluate the new functions' flaws and advantages. We also investigate the post-quantum assumption for password hashing – the effectiveness of these functions against quantum assaults, their position in a new cryptography set, and the role of peppering as an additional security measure. In addition, we perform a comprehensive compliance mapping of the PHC finalists against major global standards and regulations such as NIST SP 800-63B, OWASP ASVS, PCI DSS, GDPR, KVKK, and ISO/IEC 27001, highlighting their practical suitability for secure deployment in regulated environments. Finally, we provide usage recommendations for these functions for web authentication, KDFs, and embedded platforms. The purpose of this paper is to serve as a reference for researchers, developers, and security engineers who need to have a solid grasp of state-of-the-art password hashing and key derivation techniques.