1
$\begingroup$

From the Skein 1.3 paper section 4.8, Skein as a Password-Based Key Derivation Function (PBKDF), it mentions the following as a simple PBKDF (S = seed and P = password):

An even simpler PBKDF is to simply create a very long repetition of S and P; e.g., S||P||S||P||S..., and hash that using Skein. (Any other optional data can also be included in the repetition.) This approach is not ideal with a normal hash function, as the computation could fall into a loop. But in Skein, every block has a different tweak and is thus processed differently.

The advantages I can see is that it is very simple to implement and hard to break the implementation accidentally.

Is this a more effective PBKDF than PBKDF2?

What about being more effective than Scrypt?

Is this a memory hard approach as well as CPU intensive? I imagine for a large length string e.g. 256 bit length seed + 256 bit length password (32 ASCII chars), repeated 100,000 times, this would force an attacker to use 6MB~ of memory to test one password. I imagine this could be easily customized to use the amount of memory required to be significantly slow for calculation and also require x MBs of memory per calculation.

What is a strong security level using this method? E.g. how many repetitions of the Seed and Password would be required? 100,000? 1000,000?

| improve this question | |
$\endgroup$
  • $\begingroup$ Why would it be memory-hard? The hashing code only processes one block at a time, you don't need the entire input in memory all at once (otherwise hashing 20Tb files would be quite challenging). $\endgroup$ – Thomas Mar 21 '15 at 9:09
  • 2
    $\begingroup$ It's not memory hard and is comparable to PBKDF2. Scrypt and bcrypt are still better. $\endgroup$ – CodesInChaos Mar 21 '15 at 9:27
  • $\begingroup$ @Thomas, it would require a closer look at the Skein internals, but perhaps it requires the output from previously processed blocks to still be in memory to compute the final digest? $\endgroup$ – 504811E Mar 21 '15 at 9:29
  • $\begingroup$ @Thomas, don't you at first need to construct the x MB long string and pass it to the Skein function, thus the program is using at least x MB to do that? Or are you saying there could be a way for an attacker to tweak the Skein function implementation so it pulls in a smaller x bits of the seed and password at a time in order to hash them separately in order to reduce memory usage? $\endgroup$ – 504811E Mar 21 '15 at 9:34
  • 1
    $\begingroup$ @504811E In other words, memory usage is already independent of the length of the input. $\endgroup$ – Thomas Mar 21 '15 at 9:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.