lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 12 Jan 2016 13:42:11 +0100
From: Dmitry Khovratovich <khovratovich@...il.com>
To: "discussions@...sword-hashing.net" <discussions@...sword-hashing.net>
Cc: Jean-Philippe Aumasson <jeanphilippe.aumasson@...il.com>
Subject: Re: [PHC] Re: Attack on Argon2i?

The authors basically propose to discard the blocks between their last use
and overwrite. This strategy allows to use less memory (by a small constant
factor), though I still have to check the exact factor value.

My main technical concern is in the analysis of the multi-pass Argon2i. The
authors compute the probability of each block to survive at _every_ step,
so that these probabilities accumulate over time whereas they should not. I
will double-check the details and report on them ASAP.

Dmitry Khovratovich

On Tue, Jan 12, 2016 at 10:43 AM, Simon Josefsson <simon@...efsson.org>
wrote:

> Jean-Philippe Aumasson <jeanphilippe.aumasson@...il.com> writes:
>
> > Appendix A claims a memory reduction on Argon2i:
> > http://eprint.iacr.org/2016/027
> >
> > Not clear to me what's the actual efficiency of the improved attack
> though.
>
> It says:
>
>    it is possible to compute the single-pass variant of the Argon2i
>    password hashing function [...] using between a quarter and a fifth
>    of the desired space with no computational penalty.
>
> The attack appears to require a pre-computation phase to pre-compute the
> time after which some blocks will not be needed any more, so they can be
> discarded during the computational phase, thus saving memory.
>
> So overall the computation appears is larger, and I'm not sure in which
> attack scenario this approach would actually be useful.
>
> /Simon
>



-- 
Best regards,
Dmitry Khovratovich

Content of type "text/html" skipped

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux - Powered by OpenVZ