10 votes
Accepted

Does a big salt have the same memory effects as Bcrypt?

So in general, isn't this equivalent to what Bcrypt and PBKDF2 do in terms of password storage security? PBKDF2, yes, pretty much. The only real difference is that salt/password are used the other ...
otus's user avatar
  • 32.1k
8 votes

Memory-hard proof-of-work: are they ASIC-resistant?

Yes, the argument is largely correct. A good memory-hard proof-of-work scheme can be fairly resistant to speedup using ASIC, if designed around a good primitive like Argon2 and parametrized ...
fgrieu's user avatar
  • 141k
6 votes
Accepted

Are coprocessors (Intel Phi) a threat for modern key stretching functions?

The key idea of memory-hard functions like scrypt and Argon2, as I understand them, is to analyze the cost to the attacker in terms of a time-area product. Time is how much time the attacker spends. ...
Luis Casillas's user avatar
6 votes
Accepted

Very simple, very memory-hard (?) password-based key derivation

Leaving out the silly stuff, your algorithm amounts to: $x_0=\mathrm{const}$ $m_0=\mathrm{empty}$ $x_i=h(x_{i-1}||\mathrm{password}||\mathrm{salt})$ $m_i=m_{i-1}||x_i$ $\mathrm{result}...
CodesInChaos's user avatar
  • 24.9k
6 votes

Prove that you have $K$ bytes of memory

There has been a huge amount of work on related questions in the past years. As Thomas Prest mention, this problem was considered for memory-hard function, which provably (in some idealized models) ...
Geoffroy Couteau's user avatar
6 votes

Why do memory-hard functions rely on a time-space trade-off?

In order to create such a function you fill up memory with results of some computation; the memory-hard function then reads these values to further the computation later on. Rather than saving the ...
Meir Maor's user avatar
  • 11.8k
5 votes
Accepted

What's the ideal memory hard function?

Many of these are addressed in the article. In this setting, the "adversary" is some algorithm that can evaluate $f_n$ using less resources than we had hoped. $S$ = space/memory complexity ...
Mikero's user avatar
  • 13.3k
5 votes
Accepted

Is this simple memory-hard function good?

TL;DR: No, this is not memory-hard and may not even be as computationally intense as you would have thought. Suppose we have a hash function $H:\{0,1\}^*\to\{0,1\}^n$, for example SHA-256. Now we can ...
SEJPM's user avatar
  • 46k
5 votes

Are there any high level memory-hard PBKDF constructions?

Are there any memory-hard PBKDF constructions that can be implemented using only common standard crypto primitives, like (generic) hash functions and/or block ciphers? Of course there is one, and ...
SEJPM's user avatar
  • 46k
4 votes
Accepted

Big block cipher as memory-hard function

I've been toying around with your function, and I've come to the conclusion it's not memory hard. The amount of required memory can be reduced to at maximum ...
Daan Bakker's user avatar
4 votes

"Memory-Hard" vs. "Memory-Bound" Functions?

The Wikipedia definitions are clear; memory-bound functions; Memory bound refers to a situation in which the time to complete a given computational problem is decided primarily by the amount of ...
kelalaka's user avatar
  • 48.5k
4 votes

Cache-hard or memory-hard password hashing algorithms?

You have a lot to unpack in that question, but basically memory-hard is the way to go. From a hardware point of view, there's a few things here that you need to consider. I'm going to assume that you ...
b degnan's user avatar
  • 4,820
4 votes

Why does the GPU get a comparatively bigger advantage to the CPU when using higher parallelism in Argon2id?

Must the implementations I used be flawed, do I understand the theory wrong, the intended effect or the use of the lanes, is this hardware an outlier, or something else? You misunderstood the ...
forest's user avatar
  • 15.3k
4 votes

What does "sequential memory-hard" mean?

The Scrypt paper here defines memory-hard and sequential memory hard, and accordingly explains why one was used over the other. Definition 1. A memory-hard algorithm on a Random Access Machine is an ...
Modal Nest's user avatar
  • 1,443
3 votes
Accepted

Industry standard recommendations for memory usage defaults for a password hashing function?

If it's for a single user workload (e.g. passphrase to key derivation for encryption / cold storage of private key, local login): explore the largest that's unlikely to cause disk paging or equivalent ...
fgrieu's user avatar
  • 141k
3 votes

Prove that you have $K$ bytes of memory

I see at least one way of doing what you want to do: memory-hard functions. Alice just needs to store a value $m$ and its hash $H(m)$, where $H$ is a memory-hard function and where the parameters are ...
Thomas Prest's user avatar
  • 1,080
3 votes

Minimalist memory-hard function?

Tentative answer to my own question. Please criticize! All variables in capital are one 128-bit word, with $w=7$. Parameters are as in the question, and $k-4\le n\le128$. I use an auxiliary arbitrary ...
fgrieu's user avatar
  • 141k
3 votes

Memory-hard password-based key derivation functions?

Memory hard functions are designed so that the internal calculations rely on a relatively large state. The functions should not have shortcuts that allow an adversary to calculate the result without ...
Maarten Bodewes's user avatar
  • 92.6k
2 votes

Are there any high level memory-hard PBKDF constructions?

An alternative which appeared after the password hashing competition is Balloon hashing. It can use any standard cryptographic hash function as it's only crypto primitive; all other operations are ...
rmalayter's user avatar
  • 2,297
2 votes
Accepted

Is there a recommendation or standard for using SCRYPT as an unbounded length KDF and not a fixed length authentication hash?

The signature for scrypt, straight from the source: ...
Luis Casillas's user avatar
2 votes

Estimating difficulty of "Memory-Hard Proof-of-Work" based on "size of memory"?

The measure of resource typically used to evaluate memory-hard functions is not the amount of work (i.e., $T$-complexity) but rather the space-time complexity (i.e., $ST$-complexity) of the ...
ckamath's user avatar
  • 5,198
2 votes

Why do memory-hard functions rely on a time-space trade-off?

It is true that many memory-hard functions (MHFs) only give a time-space tradeoff. Take the example of scrypt, which was proven to have optimal cumulative memory ...
Mikero's user avatar
  • 13.3k
2 votes
Accepted

Memory-hard password hash in practice?

I'm surprised this has been left unanswered. I'll give it a go. Is Balloon hashing ready for practical use? As of 2022, I would strongly argue no. There's no standard, no standard is planned, there ...
samuel-lucas6's user avatar
1 vote

Optimal memory-hard KDF parameters when faced with small, slow memory

Your goal is to minimize the hash rate of the attacker based on the resources you have. The cracker's goal is to maximize their hash rate. Find out what parameters work well for your hardware. Pick a ...
Future Security's user avatar
1 vote

Optimal memory-hard KDF parameters when faced with small, slow memory

It depends. There is no answer that is the only right one. Increasing the memory for Argon2 increases also time needed to process it. Test your system, what is the correlation. May be increasing ...
mentallurg's user avatar
  • 2,611
1 vote
Accepted

Making attacks on password hashes less economical

I had been thinking of this question for quite a time, but without a satisfying answer: it seemed to be a problem that had never really been considered in the literature (at least, not in the ...
Geoffroy Couteau's user avatar
1 vote

What is the role played by cache misses in memory-hard password hashing?

I understand, using large memory (1GB or greater) prevent parallelism, because of the cost. I would like to support mobile and older browsers, so I use 16MB or 32MB memory maximum. This is true, but ...
axapaxa's user avatar
  • 2,940
1 vote

Very simple, very memory-hard (?) password-based key derivation

Taking a step back from CodesInChaos' excellent answer and comments, I believe your bigger-picture problem here is that you're misunderstanding the term "memory-hard function." Functions like scrypt ...
Luis Casillas's user avatar
1 vote

Attacking Scrypt Under Access Pattern Leakage

Did a bit of research and found this paper (published one year after the question was posted). According to it, it is theoretically possible to reduce scrypt to PBKDF2, e.g. eliminate the memory ...
tur11ng's user avatar
  • 962

Only top scored, non community-wiki answers of a minimum length are eligible