10
votes
Accepted
Does a big salt have the same memory effects as Bcrypt?
So in general, isn't this equivalent to what Bcrypt and PBKDF2 do in terms of password storage security?
PBKDF2, yes, pretty much. The only real difference is that salt/password are used the other ...
- 32k
8
votes
Memory-hard proof-of-work: are they ASIC-resistant?
What prevents an attacker from building a custom ASIC and buying off-the-shelf DRAM chips, and building systems that pair each ASIC with a DRAM chip?
DRAM memory is already pretty optimized for ...
- 221
8
votes
Memory-hard proof-of-work: are they ASIC-resistant?
Yes, the argument is largely correct. A good memory-hard proof-of-work scheme can be fairly resistant to speedup using ASIC, if designed around a good primitive like Argon2 and parametrized ...
- 138k
7
votes
Memory-hard proof-of-work: are they ASIC-resistant?
Memory-hard proof-of-work: are they ASIC-resistant?
Theoretically, the answer is a clear “no”.
Given enough resources (read: invested time and money) and the appropriate knowledge (ASICs don’t grow ...
- 17.8k
6
votes
Why do memory-hard functions rely on a time-space trade-off?
In order to create such a function you fill up memory with results of some computation; the memory-hard function then reads these values to further the computation later on.
Rather than saving the ...
- 11.7k
6
votes
Accepted
Very simple, very memory-hard (?) password-based key derivation
Leaving out the silly stuff, your algorithm amounts to:
$x_0=\mathrm{const}$
$m_0=\mathrm{empty}$
$x_i=h(x_{i-1}||\mathrm{password}||\mathrm{salt})$
$m_i=m_{i-1}||x_i$
$\mathrm{result}...
- 24.8k
6
votes
Prove that you have $K$ bytes of memory
There has been a huge amount of work on related questions in the past years. As Thomas Prest mention, this problem was considered for memory-hard function, which provably (in some idealized models) ...
- 19.1k
6
votes
Accepted
Are coprocessors (Intel Phi) a threat for modern key stretching functions?
The key idea of memory-hard functions like scrypt and Argon2, as I understand them, is to analyze the cost to the attacker in terms of a time-area product. Time is how much time the attacker spends. ...
- 14.4k
5
votes
Are there any high level memory-hard PBKDF constructions?
Are there any memory-hard PBKDF constructions that can be implemented
using only common standard crypto primitives, like (generic) hash
functions and/or block ciphers?
Of course there is one, and ...
- 45.7k
5
votes
Accepted
Is this simple memory-hard function good?
TL;DR: No, this is not memory-hard and may not even be as computationally intense as you would have thought.
Suppose we have a hash function $H:\{0,1\}^*\to\{0,1\}^n$, for example SHA-256. Now we can ...
- 45.7k
5
votes
Accepted
What's the ideal memory hard function?
Many of these are addressed in the article. In this setting, the "adversary" is some algorithm that can evaluate $f_n$ using less resources than we had hoped.
$S$ = space/memory complexity ...
- 12k
4
votes
"Memory-Hard" vs. "Memory-Bound" Functions?
The Wikipedia definitions are clear;
memory-bound functions;
Memory bound refers to a situation in which the time to complete a given computational problem is decided primarily by the amount of ...
- 47.6k
4
votes
What does "sequential memory-hard" mean?
The Scrypt paper here defines memory-hard and sequential memory hard, and accordingly explains why one was used over the other.
Definition 1. A memory-hard algorithm on a Random Access Machine is an ...
- 1,443
4
votes
Accepted
Big block cipher as memory-hard function
I've been toying around with your function, and I've come to the conclusion it's not memory hard. The amount of required memory can be reduced to at maximum ...
- 490
4
votes
Memory hardness of key derivation function through XOR-ring multiple matrix values
Collisions are not much of a concern, since you have to compute them to know they happen, and assuming your values are a typical hash size (256+ bits) they will never happen randomly anyway. But yes, ...
- 32k
4
votes
Why does the GPU get a comparatively bigger advantage to the CPU when using higher parallelism in Argon2id?
Must the implementations I used be flawed, do I understand the theory wrong, the intended effect or the use of the lanes, is this hardware an outlier, or something else?
You misunderstood the ...
- 15.1k
3
votes
Memory-hard password-based key derivation functions?
Memory hard functions are designed so that the internal calculations rely on a relatively large state. The functions should not have shortcuts that allow an adversary to calculate the result without ...
- 91.9k
3
votes
Prove that you have $K$ bytes of memory
I see at least one way of doing what you want to do: memory-hard functions.
Alice just needs to store a value $m$ and its hash $H(m)$, where $H$ is a memory-hard function and where the parameters are ...
- 1,082
3
votes
Minimalist memory-hard function?
Tentative answer to my own question. Please criticize!
All variables in capital are one 128-bit word, with $w=7$. Parameters are as in the question, and $k-4\le n\le128$.
I use an auxiliary arbitrary ...
- 138k
3
votes
Memory hard key derivation (password hash) using AES encryption
Your key derivation function is not particularly memory hard.
The second loop walks the array in order, so an optimized implementation which an attacker would use can avoid the whole array, keeping ...
- 32k
3
votes
Accepted
Industry standard recommendations for memory usage defaults for a password hashing function?
If it's for a single user workload (e.g. passphrase to key derivation for encryption / cold storage of private key, local login): explore the largest that's unlikely to cause disk paging or equivalent ...
- 138k
3
votes
Cache-hard or memory-hard password hashing algorithms?
You have a lot to unpack in that question, but basically memory-hard is the way to go.
From a hardware point of view, there's a few things here that you need to consider. I'm going to assume that you ...
- 4,625
2
votes
Accepted
Is there a recommendation or standard for using SCRYPT as an unbounded length KDF and not a fixed length authentication hash?
The signature for scrypt, straight from the source:
...
- 14.4k
2
votes
Estimating difficulty of "Memory-Hard Proof-of-Work" based on "size of memory"?
The measure of resource typically used to evaluate memory-hard functions is not the amount of work (i.e., $T$-complexity) but rather the space-time complexity (i.e., $ST$-complexity) of the ...
- 5,133
2
votes
Why do memory-hard functions rely on a time-space trade-off?
It is true that many memory-hard functions (MHFs) only give a time-space tradeoff. Take the example of scrypt, which was proven to have optimal cumulative memory ...
- 12k
2
votes
Are there any high level memory-hard PBKDF constructions?
An alternative which appeared after the password hashing competition is Balloon hashing. It can use any standard cryptographic hash function as it's only crypto primitive; all other operations are ...
- 2,287
2
votes
Cache-hard or memory-hard password hashing algorithms?
What are the pros and cons of cache-hardness vs memory-hardness?
cache-hard algorithms' authors argue that memory-hard algorithm isn't suitable for password hashing, because the password hashing ...
- 21
1
vote
Optimal memory-hard KDF parameters when faced with small, slow memory
Your goal is to minimize the hash rate of the attacker based on the resources you have. The cracker's goal is to maximize their hash rate.
Find out what parameters work well for your hardware. Pick a ...
- 3,283
1
vote
Optimal memory-hard KDF parameters when faced with small, slow memory
It depends. There is no answer that is the only right one.
Increasing the memory for Argon2 increases also time needed to process it. Test your system, what is the correlation. May be increasing ...
- 2,581
1
vote
Accepted
Making attacks on password hashes less economical
I had been thinking of this question for quite a time, but without a satisfying answer: it seemed to be a problem that had never really been considered in the literature (at least, not in the ...
- 19.1k
Only top scored, non community-wiki answers of a minimum length are eligible