phc-discussions - Re: [PHC] Design Rationale and Security Analysis of PHC candidates

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALW8-7+xo_BBbkPa-GCe3de6mMo5auK_qOK4tHsmmOMZJURJ0g@mail.gmail.com>
Date: Wed, 1 Oct 2014 19:07:34 +0200
From: Dmitry Khovratovich <khovratovich@...il.com>
To: "discussions@...sword-hashing.net" <discussions@...sword-hashing.net>
Subject: Re: [PHC] Design Rationale and Security Analysis of PHC candidates

Hi Marcos,

thank you for the response!

my understanding was that page 22 and Section 5.1.3 in
https://password-hashing.net/submissions/specs/Lyra2-v1.pdf contain some
analysis of using less memory than intended. In particular, you describe
how to use 1/2 of memory in the Setup phase (page 22) and in the Wandering
phase (page 25).

Maybe wording "claims" was too strong in my document, it would be better to
say that there exist third-party results more efficient than the original
analysis.

I did not look into tweaks intentionally, I'd prefer to wait till they are
approved by the committee.

Best regards,
Dmitry

On Wed, Oct 1, 2014 at 6:43 PM, Marcos Simplicio <mjunior@...c.usp.br>
wrote:

> Hi.
>
> I'm not sure whether "attacked" applies to the 'Tradeoff analysis" of
> Lyra2: originally there were no claims on attacks involving half of the
> memory usage, but only against a very low memory usage.
>
> We do have such claims in the new version to be submitted (assuming
> Lyra2 moves to the phase in which such tweaks are allowed), and the
> attack venue described does not seem to be effective in that case.
>
> Also, the "FPGA/ASIC defense" does not take into account all tweaks
> described in the documentation, although I agree with "attacked" if you
> consider only the basic design and ignores this part of the document.
>
> Anyhow, very interesting analysis!
>
> BR,
>
> Marcos Simplicio
>
>
> On 30-Sep-14 08:12, Dmitry Khovratovich wrote:
> > We have prepared a small survey of the design rationale and security
> > analysis of the PHC submissions. It should help the committee to evaluate
> > the candidates and the community to see the status and potential
> strengths
> > and weaknesses of the candidates.
> >
> > We are welcome to any feedback. We plan to add further information to the
> > tables, possibly in the spirit of Microsoft criteria.
> >
> > The permanent link is
> >
> > https://www.cryptolux.org/images/4/4f/PHC-overview.pdf
> >
>



-- 
Best regards,
Dmitry Khovratovich

Content of type "text/html" skipped