phc-discussions - Re: [PHC] Another PHC candidates "mechanical" tests (ROUND2)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 31 Mar 2015 02:17:38 +0800
From: Hongjun Wu <wuhongjun@...il.com>
To: discussions@...sword-hashing.net
Subject: Re: [PHC] Another PHC candidates "mechanical" tests (ROUND2)

Dear Jakob,

I see. The output of POMELO is designed to be random.

You may mark POMELO as KDF.   Thanks.

Best Regards,
hongjun


On Tue, Mar 31, 2015 at 12:22 AM, Jakob Wenzel <jakob.wenzel@...-weimar.de>
wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 30.03.2015 13:52, Milan Broz wrote:
> > On 03/30/2015 01:24 PM, Solar Designer wrote:
> >> Milan,
> >>
> >> On Tue, Mar 24, 2015 at 11:50:44PM +0100, Milan Broz wrote:
> >>> The updated test report (draft) is here
> >>>
> >>> https://github.com/mbroz/PHCtest/blob/master/output/phc_round2.pdf
> >>
> >>
> >>>
> >>>
> This really needs the cross-chart we discussed - memory usage vs. real
> >> time with increasing m_cost and fixed lowest supported t_cost.
> >> From your charts, it was - and still is - not apparent to me
> >> that (or whether?) POMELO v2 performs so well (as the author
> >> claims) at large memory settings.
> >
> > Yes, I'll plan to look into this soon.
> >
> >> And you did not include it in Table 4 ("Ability to cover real
> >> use-case limits"), I guess because it was unclear even to you
> >> that it's competitive for your use case.
> >
> > It is not there because I did not find any mention that POMELO can
> > be used directly as a KDF in the paper (and the use case is for
> > KDF). The garbage-collector attack paper
> > http://eprint.iacr.org/2014/881 also mentions that it is not KDF
> > in Table 4.
> >
> > Could authors clarify that?
>
> Hi,
>
> we did not mark POMELO as a KDF for the following reasons:
>
> The authors of POMELO (v2)
> 1) ...did not claim that POMELO can be used as a KDF
> 2) ...neither claimed nor proved randomness of the outputs which is
>    required for a good KDF
>
> Best regards,
> Jakob
> (one of the authors of http://eprint.iacr.org/2014/881)
>
>
> - --
> Jakob Wenzel
> Research Assistant
> Chair of Media Security (Prof. Lucks)
> Bauhausstraße 11 (Room 217)
> 99423 Weimar
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
>
> iQEcBAEBAgAGBQJVGXg1AAoJEDFlRQsgEDnDG0kH/0oOH9KYK6gB/NMTnMpZswU8
> yhSZERlnKg/jcqmS6WnIS2/PBm2C3faWEMk3sprlEA1S3r4KDY5UKQmDhdABfG3I
> 2ejmyufn1rxkbCZ1E8J+asdMxhS7hzVNX1Tm/w/kj5u6q+JNph+1WfVst+VT0ECX
> cQ5eENVsPWyMcSfzkvbqD+X0A9b92+jhJtS8xbgIq8EQVk2yNE2X1/B4to34bWSt
> MFEJgrtiZDlVpuxIJw4H+C4o1FOTdO7XB1okKePK1noeYuWtcj3p5a9XcKK/CN6u
> BDTQz/i8MmgtoSR1siVhaGX8cB0UrV0+9R/50yhHkRcqWlasfzi1Nmn/TsDDz+Q=
> =8ap7
> -----END PGP SIGNATURE-----
>

Content of type "text/html" skipped