phc-discussions - Re: [PHC] Argon2 modulo division

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAOLP8p7XKMGq_xdWtK2x2aEWCPof4nmjLXEY4EG0iQfriF0ksg@mail.gmail.com>
Date: Wed, 29 Apr 2015 09:15:32 -0700
From: Bill Cox <waywardgeek@...il.com>
To: "discussions@...sword-hashing.net" <discussions@...sword-hashing.net>
Subject: Re: [PHC] Argon2 modulo division

Just for fun, here's TwoCat's histograms.  I also attacked hist.c which
generates them.  My histogram outputs are sideways...

20 buckets:

 10.8 **************************************************
  9.7 ********************************************
  8.8 ****************************************
  7.9 ************************************
  7.0 ********************************
  6.1 ****************************
  5.3 ************************
  4.5 ********************
  3.9 ******************
  3.5 ***************
  4.6 *********************
  4.3 *******************
  4.1 *******************
  3.8 *****************
  3.6 ****************
  3.2 **************
  2.9 *************
  2.5 ***********
  2.2 **********
  1.4 ******

The reason for the bimodal distribution is the hybrid architecture.  The
first loop uses a sliding window, within which I do a bit-reversal,
generating a distribution much like smix1.  The second loop does a
distance-cubed distribution, which still accesses eary memory pretty often,
but more often accesses more recently written memory.

Here's the histograms for quarters:

 44.2 **************************************************
 23.3 **************************
 20.3 ***********************
 12.2 *************

and for halves:

 67.4 **************************************************
 32.6 ************************

The distance-cubed access pattern not only evens out tthe distriution, but
it also gives significantly higher TMTO resistance.  It both increases
Dmity's depth function D, and increases the total memory needing
recomputing for high TMTO attacks.  If you go more agressive than distance
cubed, like logarithmic, your computation graph gets too narrow and gives
attackers narrow cuts, enabling very effective TMTO attacks.

The distance-cubed distributions is the best memory access pattern I tested
against my own TMTO attacks.  I would highly recomend it for Argon2d.

Bill

Content of type "text/html" skipped