phc-discussions - Re: [PHC] Generalised password hashing for arbitrary proof of work

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 08 Sep 2014 20:49:12 -0400
From: Bill Cox <waywardgeek@...hershed.org>
To: discussions@...sword-hashing.net
Subject: Re: [PHC] Generalised password hashing for arbitrary proof of work

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 09/08/2014 11:22 AM, Krisztián Pintér wrote:
> On Mon, Sep 8, 2014 at 6:00 AM, Ben Harris <ben@...rr.is> wrote:
>> I've been looking at Cuckoo Cycle 
>> (https://github.com/tromp/cuckoo/blob/master/cuckoo.pdf?raw=true)
>> as a proof
> 
> can someone explain me how this does not leak information through 
> total running time? (that is, not cache timing, but traffic
> analysis.)
> 

For proof of work, I don't think they care about leaking meta data.
They seem more interested in being able to easily prove that they did
all the work they claim.

I would need to look more carefully, but at first glance I like it for
proof of work, but would pass on trying to use it for password hashing.

Bill
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJUDk6EAAoJEAcQZQdOpZUZchMP/R9tC1oSb89a3CybDDOHEV8/
SR+KwqFTB4eJGxI4ffx1VGZl1TR7i/nKqfziVxPyIbT+gDKCKuH+V6vysmQH/RE6
ZdroUxPYd1vTcuULdqDlRfjHgKiNY8wmHTiJeHp+ULWhM09803AnSEwGfiL/ZqEG
YMF88FWKrL13ZbBg10zBzkY+p4NEC+LD65fryjNa//V4t31RaG1Zsg4oSA3yRhn+
ldnoT+wtgp7ASQ03HV0NNk+Vtx2NS2XPGs/7eOKKUhbssGXChkjV8qyuDa6fBjMR
4blU2Y2m86V4v9btT7q4SJoE/awN1oOUmKMv33d/U8tZsnS+jPsonhdPx80E/ueJ
XW0GWbwM9u7FBiEx6XDxt4aLxic8N2sPaq+qiUy0f+YEfwkHqw9lKF+tGTR46ApU
EMUPvUzbR3/2hO2X6hVSnI5wOdUtbt+0idB487x7181xiVWgoueGaCUFhu6kMfvE
xuAe7gWk4IaW/4zTCGc7o041lP7njEgGm0oVdSn8b3ZBms0vycIXipRigUwrO+Gd
1hrSUoUtaXDNYw8bPGvgzyXcUSl6swaNetcNekN0kmVMj74Dwch256IcHXp18FHz
kBfc5AU+va7anx3WWyuwazSF1jgGNeHCBe6S0mLYdCGwkLB7C6SkY6bBZN+9xI9r
dw7xLexvZbkm1tWRnZx0
=5xUh
-----END PGP SIGNATURE-----