lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 4 Jul 2015 21:45:22 +0300
From: Solar Designer <solar@...nwall.com>
To: discussions@...sword-hashing.net
Subject: Re: [PHC] Memory-hard proof of work with fast verification (CPU Hash)

On Sat, Jul 04, 2015 at 11:22:03AM -0700, Bill Cox wrote:
> Why is shared access to ROM where each process needs to read random blocks
> from ROM faster than shared access to read/write RAM?

It usually is not.

> Aren't both I/O bandwidth limited?

They are.

> Why would RAM bandwidth be lower?

It wouldn't.

> The ROM block hash needs to be fast to fill the memory bandwidth.  I would
> use a 2-round Yescrypt hash (or something even faster) in this case.

GPUs have enough compute power that you'd be able to bump into the
memory bandwidth even without having to lower the round count if it were
e.g. scrypt's Salsa20, however:

> Small
> rapid unpredictable read/writes to the small RAM are also needed to defeat
> today's GPUs, but Yescrypt already has this.

This changes things dramatically, likely introducing a new bottleneck
(on purpose).

In my previous reply, I deliberately did not consider yescrypt's
pwxform.  It sounded like you wanted to consider specifically the ROM
defense.  So I was thinking more like scrypt enhanced to have a ROM,
without also having other changes that I made in yescrypt.

> With Yescrypt's further GPU defense, I think it would be fine.

Sure, but this makes your 512 MB ROM sort of irrelevant for GPU attacks.
They can have that 512 MB in their GPU card's RAM, and will run almost as
fast (for a trivial enhancement of scrypt) or just as slow (for yescrypt
with pwxform).

Alexander

Powered by blists - more mailing lists