phc-discussions - Re: [PHC] Response to recent comments on Rig

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <540B2E75.3030506@ciphershed.org>
Date: Sat, 06 Sep 2014 11:55:33 -0400
From: Bill Cox <waywardgeek@...hershed.org>
To: discussions@...sword-hashing.net
Subject: Re: [PHC] Response to recent comments on Rig

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I went ahead and did a basic RIG benchmark with the code submitted.
It hashes 1GiB on my test machine with t_cost = 4 (similar graph to
Catena-3) in 2.27s.  This is worse than Scrypt, but many times better
than any other cache-timing resistant algorithm.

The cache-timing password defense provided by TwoCats in terms of
memory*time cost is about 16X lower than Catena and RIG
architecturally for a few different reasons I explained in my
submission.  However, TwoCats on a a single thread and minimum
multiplication chains does a 1GiB hash in 0.22s.

I conclude that RIG (once fixed) likely provides about a 50% better
time*memory defense against a brute-force password guessing attack
with cache-timing data.  That makes it the strongest in the
competition in this category.  Second would be TwoCats :-)

Bill
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJUCy5xAAoJEAcQZQdOpZUZyPEP/R0eNHxmRalyExzID6vT6/1Y
Pr9yDHfX+IZeWEHV8wT4Sp/+R64G6TuGqd8JETMwm6G8PbM7+Cl4eXh5Z2NW+EdT
2k502JUVycWV2yTayk/nLW89VYFPa2ExmtPDMbP17lUtHOXHgHMXgUoX0pgA4DpU
23vbLykLhkdMX82HOP4dhy/g/RZZRjAesf4ceDUxjIwJxSbZ60BkSjF1qqM/JTfD
ApT4Nl3BhyQYBkmnufBfxUoVHjEJ3+uFGxMcGZjmhUIzxjE0KpNE3xMGYye7WgMT
wr2oi0rJWQsJatzL1mW1cK/pJBOqwSbrJqFj3wddNed2mTl8RQ962lbLKkF9J576
Y5j+lmcN6jK3GofbAOXqjDczfBhhyIeGtPAiqCl6o9oMfoX6tG05Cniq2/k9HibS
a2vQPfkLpVfYFNv8T8TLr86Ue3MA/F5sh385L6f5/JiQ6sLVRmnp6Cj0QcV1ljMn
iG/vUUc/bHZnYvdnUbchFBA6z1BfJwZlyclLqQhEAMIwA7TIEZCo9gd2Ni5uY2oR
qWox1uHnzTx05HmOucFoa16COBWwtb4p/PtT84m37DvoEEKRSipOlL+lIr3Ii1jo
8DP1c6SSnpsZsibgpG6qtPR9jzlip9DVkhW9NnsQirLjgRh9dkf5NRJHoBCqrqwE
Cztyf+MWHrKR7+zcotzx
=fISO
-----END PGP SIGNATURE-----