From the Skein 1.3 paper section 4.8, Skein as a Password-Based Key Derivation Function (PBKDF), it mentions the following as a simple PBKDF (S = seed and P = password):

An even simpler PBKDF is to simply create a very long repetition of S and P; e.g., S||P||S||P||S..., and hash that using Skein. (Any other optional data can also be included in the repetition.) This approach is not ideal with a normal hash function, as the computation could fall into a loop. But in Skein, every block has a different tweak and is thus processed differently.

The advantages I can see is that it is very simple to implement and hard to break the implementation accidentally.

Is this a more effective PBKDF than PBKDF2?

What about being more effective than Scrypt?

Is this a memory hard approach as well as CPU intensive? I imagine for a large length string e.g. 256 bit length seed + 256 bit length password (32 ASCII chars), repeated 100,000 times, this would force an attacker to use 6MB~ of memory to test one password. I imagine this could be easily customized to use the amount of memory required to be significantly slow for calculation and also require x MBs of memory per calculation.

What is a strong security level using this method? E.g. how many repetitions of the Seed and Password would be required? 100,000? 1000,000?

  • $\begingroup$ Why would it be memory-hard? The hashing code only processes one block at a time, you don't need the entire input in memory all at once (otherwise hashing 20Tb files would be quite challenging). $\endgroup$
    – Thomas
    Mar 21, 2015 at 9:09
  • 2
    $\begingroup$ It's not memory hard and is comparable to PBKDF2. Scrypt and bcrypt are still better. $\endgroup$ Mar 21, 2015 at 9:27
  • $\begingroup$ @Thomas, it would require a closer look at the Skein internals, but perhaps it requires the output from previously processed blocks to still be in memory to compute the final digest? $\endgroup$
    – 504811E
    Mar 21, 2015 at 9:29
  • $\begingroup$ @Thomas, don't you at first need to construct the x MB long string and pass it to the Skein function, thus the program is using at least x MB to do that? Or are you saying there could be a way for an attacker to tweak the Skein function implementation so it pulls in a smaller x bits of the seed and password at a time in order to hash them separately in order to reduce memory usage? $\endgroup$
    – 504811E
    Mar 21, 2015 at 9:34
  • 1
    $\begingroup$ @504811E In other words, memory usage is already independent of the length of the input. $\endgroup$
    – Thomas
    Mar 21, 2015 at 9:42


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.