Why can't people make a hash function that requires dozens of mega bytes of memory instead of cpu to avoid all the cracking and hacking?
What I have in mind myself is this:
- We have an input $X$, we choose hash function SHA2-256, make a multi-megabyte array.
- Hash $X$ and put it in the beginning of the array.
- Hash the previous hash and put it next to it.
- Step 3 until the array is full
- Reverse the array
- Hash the array in N passes, In each pass reading 1 byte and skipping $N-1$
I'm planning to use this for authentication, I'm not sure if it's a good idea or not, just need to know if it stop the damn GPUs from cracking my passwords.
This is why people shouldn't make their own encryption – see the comment by John Meacham proving this algorithm insecure. An easy fix IMO is to require the algorithm to go multiple passes over the reversed array. Like: get the first byte, skip 15 bytes, get another byte and so on… and when we reach end of the array, start from beginning, only this time we get the second byte, skip 15 bytes and so on… and we do this 16 times until we have read every byte in the array. Of course number $16$ is probably not a good number but still I think the whole idea is good.