lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sat, 29 Mar 2014 11:54:07 -0400
From: Bill Cox <>
Subject: Should SkinnyCat have memCost and timeCost?

It's been a couple of wonderful days since submitting TwoCats, and
since then, I've only found a couple of typos in the paper.  I'm
getting real work done again at my day job :-)

There is only one minor issue nagging at me: the stripped-down subset
of TwoCats called SkinnyCat takes only a memCost parameter, not both a
memCost and a timeCost.  For compute-time hardening in SkinnyCat, I
would repeat the inner block hash loop 2^timeCost times rather than
using multiplication chains.  TwoCats, being the full featured
version, does both.  The idea is that repeatedly hashing the same
small block of memory that fits in L1 cache over and over before
moving to the next block is hard for an attacker to speed up, because
our L1 CPU caches are fast.  It also would allow SkinnyCat to be used
in low memory situations where long runtimes are still desired.

On the other hand, many users are likely to get confused with 2 cost
parameters, and there is already some compute time hardness in
SkinnyCat due to it's high external memory bandwidth.  It also adds
complexity to SkinnyCats, which is antithetical to it's design goal.

I know this isn't terribly important.  I can probably change it in the
"tweaking" phase anyway.  What do you think?  Should a KISS PHS
include a time cost parameter?


Powered by blists - more mailing lists