The Password Hashing Competition offers several memory-hard hashing algorithms that are aware of time memory trade-off and essentially try to make it hard for ASICs and FPGAs to brute-force hashes.

Is there something similar available for asymmetric encryption?

  • 4
    $\begingroup$ What properties would a "memory-hard asymmetric encryption" have? Would it be one where you have to have a lot of memory to encrypt? Or, do you need a lot of memory (and the private key) to decrypt? $\endgroup$
    – poncho
    Jul 14, 2016 at 18:21
  • $\begingroup$ Using an expensive hash to produce shorter public key finger prints is the only sensible deliberately expensive operation related to asymmetric crypto I can think of. $\endgroup$ Jul 14, 2016 at 18:49
  • $\begingroup$ @poncho encryption/decryption as far as the regular process go are not quite the intended goal for memory-hard. It's when a third party tries to gain access to what is encrypted, without having any key. Essentially forcing the attacker to need a lot of memory trying to decrypt without access to a key. Does this answer your question? $\endgroup$
    – Oipo
    Jul 14, 2016 at 19:35
  • 2
    $\begingroup$ The only reason why we're using expensive password hashes is that users refuse the memorize strong passwords. If users could memorize passwords with 128+ bits of entropy, we wouldn't bother with expensive hashes. When dealing with computers, you can simply use big enough keys to make brute-force infeasible. $\endgroup$ Jul 14, 2016 at 20:24
  • 2
    $\begingroup$ "It's hard to decrypt without the private key if you don't have a lot of memory"; I believe that any secure public key encryption system meets that criteria :-) $\endgroup$
    – poncho
    Jul 14, 2016 at 20:45