phc-discussions - Re: [PHC] a sponge based approach

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <163129294.20130813183237@gmail.com>
Date: Tue, 13 Aug 2013 18:32:37 +0200
From: Krisztián Pintér <pinterkr@...il.com>
To: CodesInChaos <discussions@...sword-hashing.net>
Subject: Re: [PHC] a sponge based approach

> It's a fixed pattern, 

well, it has to be a fixed pattern, since i chose to follow the principle of no branching or indexing on secret. the only other option would be a pattern based on the salt, but it makes little difference if the attacker attacks a single password at a time.

> so the "save every sqrt(n)th" value technique
> which reduces cost for the attacker to n^{3/2} 

i would like to familiarize myself a little better with that argument. do you have any link how to derive that? my math is a little rusty, and i keep getting no gain. also, what is the "cost" in this calculation? steps * memory?

> For small f (i.e. f<<sqrt(m))

this never happens, f is either m-1 or something like 100m/101. m/2 worst case. for keccak, f would be much closer to m than m/2.