phc-discussions - Re: [PHC] Comparing speed of entries

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAOLP8p63Sanm43FQXjNxPo+Ear4qrM=JqBGe3SEwhdGD6_2QUQ@mail.gmail.com>
Date: Mon, 2 Mar 2015 15:10:00 -0800
From: Bill Cox <waywardgeek@...il.com>
To: "discussions@...sword-hashing.net" <discussions@...sword-hashing.net>
Subject: Re: [PHC] Comparing speed of entries

On Mon, Mar 2, 2015 at 7:41 AM, Solar Designer <solar@...nwall.com> wrote:

> On Mon, Mar 02, 2015 at 06:10:25AM -0800, Bill Cox wrote:
> > Please excuse and correct mistakes below.
> [...]
> > Yescrypt wit t_cost == 1 (my preferred setting),
>
> Why not 0?

My mistake!  I got confused when re-reading the loop count logic.

So, with t_cost == 0, and read/write enabled, Yescrypt does 2 I/O
operations (one read, one write), in the first loop to fill memory, and the
second loop does another N/3 block reads and writes.  This is 8/3 N
read/writes and 4/3 N block hashes, right?

This is even faster than what I said above.  Yescrypt is the clear speed
leader, IMO.

> lower than any other remaining entry.  My old TwoCats did 1 :-)
>
> Yes, but I think it makes more sense to count I/O's per memory block.
> The "hashes" may be easily scaled one way or the other by adjusting the
> round count of the primitive - well, except that we don't want to go
> below 1 round.

I agree, but it is handy to count both block hashes and I/O operations.
Yescrypt is the fastest remaining entry on both counts.  The main point
here is that Yescrypt is inherently the fastest remaining algorithm.  It
does this while also winning in nearly every other important defense
measure.

Marco does have a good point that we need to take the novel hash methods
into account, and speed is a factor there.  I think it is fair to compare
the speed of Lyra2 with one reduced Blake2b round to Yescrypt with one
wide-transform round.

Bill

Content of type "text/html" skipped