phc-discussions - Re: [PHC] Overview of PHC Candidates and Garbage-Collector Attacks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALW8-7Ke3X9ovJJU20kj4oXJGMsvMhhA=DJtogEqwVCRYz5dnA@mail.gmail.com>
Date: Thu, 30 Oct 2014 21:36:13 +0100
From: Dmitry Khovratovich <khovratovich@...il.com>
To: "discussions@...sword-hashing.net" <discussions@...sword-hashing.net>
Subject: Re: [PHC] Overview of PHC Candidates and Garbage-Collector Attacks

Hi Jakob,

interesting paper and survey!

I would note that both definitions 1 and 2 are ambiguous in what can be
considered an efficient function or adversary. If you make Def 1 more
rigorous by specifying a constant Q such that O(f(x)) < O(PS(x))/Q, then
the definition seems to implicitly require to discard/overwrite/nullify the
first 1/Q outputs of the internal compression function/block generator. For
one-pass schemes this is equivalent to the total memory reduction by the
fraction of (1-1/Q), whereas all two-pass schemes seem to satisfy this
constraint.

Even that reduction seems to be relevant to schemes with data-dependent
addressing only, because the schemes with data-independent addressing
either have two passes or more, or badly suffer from tradeoff attacks (it
is easy to show reduction in the time-area product for (virtually) all
one-pass data-independent schemes).

Best regards,
Dmitry

On Wed, Oct 29, 2014 at 6:38 PM, Jakob Wenzel <jakob.wenzel@...-weimar.de>
wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hi all,
>
> under the following link you can find an overview of all PHC
> candidates which are not yet withdrawn:
>
> https://eprint.iacr.org/2014/881.pdf
>
> It focuses on comparing general and security properties. Moreover, it
> formally introduces the two attack types garbage-collector attacks and
> weak garbage-collector attacks. For each candidate, we argue why it
> provides resistance against these attack types or we actually show an
> attack.
>
> Best regards,
> Jakob
>
> - --
> Jakob Wenzel
> Research Assistant
> Chair of Media Security (Prof. Lucks)
> Bauhausstraße 11 (Room 217)
> 99423 Weimar
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
>
> iQEcBAEBAgAGBQJUUSYSAAoJEDFlRQsgEDnDkagH+wSUt1JLKXTxXYrIWuRuR5je
> B6xRlIzSUIPXUcVJJLVeeL6oQ46S6orbZ63cRdOBTd50TM4+qOViViw75JK2rTGx
> kdN5q/NPBD7xdoPNOISSYiyP0Dx52QjqPE5Z/0ypg08yfGAvCRSAVMJz1YEFOF2E
> 9/TmVnDp4/471ybnELnqFXb3fcCDb7yIgw7yvc47dYa8At7Qgw8CPdO+YnEG7vFY
> 0jxir35KusWKzmYyfnJruiVK3fwW9AeulgSF0GH6YV17kNzFpV1z+M0GacOP+Qwo
> 6ljxStfJPeD9KZ9Y2Sd/vjiauvIeUW3M66wwfwPDeNiGXYfUlE3phalwyeUzo7o=
> =1j21
> -----END PGP SIGNATURE-----
>

-- 
Best regards,
Dmitry Khovratovich

Content of type "text/html" skipped