phc-discussions - Should SkinnyCat have memCost and timeCost?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Sat, 29 Mar 2014 11:54:07 -0400
From: Bill Cox <waywardgeek@...il.com>
To: discussions@...sword-hashing.net
Subject: Should SkinnyCat have memCost and timeCost?

It's been a couple of wonderful days since submitting TwoCats, and
since then, I've only found a couple of typos in the paper.  I'm
getting real work done again at my day job :-)

There is only one minor issue nagging at me: the stripped-down subset
of TwoCats called SkinnyCat takes only a memCost parameter, not both a
memCost and a timeCost.  For compute-time hardening in SkinnyCat, I
would repeat the inner block hash loop 2^timeCost times rather than
using multiplication chains.  TwoCats, being the full featured
version, does both.  The idea is that repeatedly hashing the same
small block of memory that fits in L1 cache over and over before
moving to the next block is hard for an attacker to speed up, because
our L1 CPU caches are fast.  It also would allow SkinnyCat to be used
in low memory situations where long runtimes are still desired.

On the other hand, many users are likely to get confused with 2 cost
parameters, and there is already some compute time hardness in
SkinnyCat due to it's high external memory bandwidth.  It also adds
complexity to SkinnyCats, which is antithetical to it's design goal.

I know this isn't terribly important.  I can probably change it in the
"tweaking" phase anyway.  What do you think?  Should a KISS PHS
include a time cost parameter?

Bill