lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 29 Apr 2015 09:15:32 -0700
From: Bill Cox <waywardgeek@...il.com>
To: "discussions@...sword-hashing.net" <discussions@...sword-hashing.net>
Subject: Re: [PHC] Argon2 modulo division

Just for fun, here's TwoCat's histograms.  I also attacked hist.c which
generates them.  My histogram outputs are sideways...

20 buckets:

 10.8 **************************************************
  9.7 ********************************************
  8.8 ****************************************
  7.9 ************************************
  7.0 ********************************
  6.1 ****************************
  5.3 ************************
  4.5 ********************
  3.9 ******************
  3.5 ***************
  4.6 *********************
  4.3 *******************
  4.1 *******************
  3.8 *****************
  3.6 ****************
  3.2 **************
  2.9 *************
  2.5 ***********
  2.2 **********
  1.4 ******

The reason for the bimodal distribution is the hybrid architecture.  The
first loop uses a sliding window, within which I do a bit-reversal,
generating a distribution much like smix1.  The second loop does a
distance-cubed distribution, which still accesses eary memory pretty often,
but more often accesses more recently written memory.

Here's the histograms for quarters:

 44.2 **************************************************
 23.3 **************************
 20.3 ***********************
 12.2 *************

and for halves:

 67.4 **************************************************
 32.6 ************************

The distance-cubed access pattern not only evens out tthe distriution, but
it also gives significantly higher TMTO resistance.  It both increases
Dmity's depth function D, and increases the total memory needing
recomputing for high TMTO attacks.  If you go more agressive than distance
cubed, like logarithmic, your computation graph gets too narrow and gives
attackers narrow cuts, enabling very effective TMTO attacks.

The distance-cubed distributions is the best memory access pattern I tested
against my own TMTO attacks.  I would highly recomend it for Argon2d.

Bill

Content of type "text/html" skipped

Powered by blists - more mailing lists