lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 13 Aug 2013 18:32:37 +0200
From: Krisztián Pintér <>
To: CodesInChaos <>
Subject: Re: [PHC] a sponge based approach

> It's a fixed pattern, 

well, it has to be a fixed pattern, since i chose to follow the principle of no branching or indexing on secret. the only other option would be a pattern based on the salt, but it makes little difference if the attacker attacks a single password at a time.

> so the "save every sqrt(n)th" value technique
> which reduces cost for the attacker to n^{3/2} 

i would like to familiarize myself a little better with that argument. do you have any link how to derive that? my math is a little rusty, and i keep getting no gain. also, what is the "cost" in this calculation? steps * memory?

> For small f (i.e. f<<sqrt(m))

this never happens, f is either m-1 or something like 100m/101. m/2 worst case. for keccak, f would be much closer to m than m/2.

Powered by blists - more mailing lists