lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 30 Oct 2014 21:36:13 +0100
From: Dmitry Khovratovich <khovratovich@...il.com>
To: "discussions@...sword-hashing.net" <discussions@...sword-hashing.net>
Subject: Re: [PHC] Overview of PHC Candidates and Garbage-Collector Attacks

Hi Jakob,

interesting paper and survey!

I would note that both definitions 1 and 2 are ambiguous in what can be
considered an efficient function or adversary. If you make Def 1 more
rigorous by specifying a constant Q such that O(f(x)) < O(PS(x))/Q, then
the definition seems to implicitly require to discard/overwrite/nullify the
first 1/Q outputs of the internal compression function/block generator. For
one-pass schemes this is equivalent to the total memory reduction by the
fraction of (1-1/Q), whereas all two-pass schemes seem to satisfy this
constraint.

Even that reduction seems to be relevant to schemes with data-dependent
addressing only, because the schemes with data-independent addressing
either have two passes or more, or badly suffer from tradeoff attacks (it
is easy to show reduction in the time-area product for (virtually) all
one-pass data-independent schemes).

Best regards,
Dmitry

On Wed, Oct 29, 2014 at 6:38 PM, Jakob Wenzel <jakob.wenzel@...-weimar.de>
wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hi all,
>
> under the following link you can find an overview of all PHC
> candidates which are not yet withdrawn:
>
> https://eprint.iacr.org/2014/881.pdf
>
> It focuses on comparing general and security properties. Moreover, it
> formally introduces the two attack types garbage-collector attacks and
> weak garbage-collector attacks. For each candidate, we argue why it
> provides resistance against these attack types or we actually show an
> attack.
>
> Best regards,
> Jakob
>
> - --
> Jakob Wenzel
> Research Assistant
> Chair of Media Security (Prof. Lucks)
> Bauhausstra├če 11 (Room 217)
> 99423 Weimar
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
>
> iQEcBAEBAgAGBQJUUSYSAAoJEDFlRQsgEDnDkagH+wSUt1JLKXTxXYrIWuRuR5je
> B6xRlIzSUIPXUcVJJLVeeL6oQ46S6orbZ63cRdOBTd50TM4+qOViViw75JK2rTGx
> kdN5q/NPBD7xdoPNOISSYiyP0Dx52QjqPE5Z/0ypg08yfGAvCRSAVMJz1YEFOF2E
> 9/TmVnDp4/471ybnELnqFXb3fcCDb7yIgw7yvc47dYa8At7Qgw8CPdO+YnEG7vFY
> 0jxir35KusWKzmYyfnJruiVK3fwW9AeulgSF0GH6YV17kNzFpV1z+M0GacOP+Qwo
> 6ljxStfJPeD9KZ9Y2Sd/vjiauvIeUW3M66wwfwPDeNiGXYfUlE3phalwyeUzo7o=
> =1j21
> -----END PGP SIGNATURE-----
>



-- 
Best regards,
Dmitry Khovratovich

Content of type "text/html" skipped

Powered by blists - more mailing lists