lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 18 Jul 2015 21:28:05 +0300
From: Solar Designer <>
Subject: Re: [PHC] patents

On Thu, Jul 16, 2015 at 11:23:59AM +0200, Dmitry Khovratovich wrote:
> That's sad. The MSR paper you mention is probably

No, not that one.  And I actually recalled incorrectly.  Here's an
excerpt from an email Jeremy sent me in March 2015:

| Last December, I was reading a Microsoft Research paper, 'An
| Administrator's Guide to Internet Password Research' [1] and I noticed a
| footnote, 'Perfectly Secure Password Protocols in the Bounded Retrieval
| Model', for a paper published in 2006. A few days later I was searching
| for a link back to the paper, and stumbled upon their patent [2]. As soon
| as I learned about it, we filed a disclosure to the patent office to cited
| it as a reference. I'm not currently aware of any other patents in this
| space.
| [1] -
| [2] -

My sadness and anger aside, I appreciated this info.  Thanks, Jeremy.

I am sorry for directly posting an excerpt of a private email to a
public list, but I felt I had to make the info public anyway and I
wouldn't have worded it better.  I hope Jeremy understands and agrees.

So the recent MSR paper was merely referring to an older paper by other
authors.  I don't recall ever seeing the older paper itself, and I did
not read the patent, but I did read (after Jeremy's email in March) the
one-paragraph summary on page 11 in WhatsaSysadminToDo.pdf referenced
above.  It's reference [15] in there.

> On Thu, Jul 16, 2015 at 10:48 AM, Solar Designer <> wrote:
> > The other patent, which I also haven't read closely, covers an idea
> > expressed in IIRC a Microsoft Research paper from several years ago.
> > In the paper, it's essentially the same idea Steve Thomas proposed
> > shortly before Passwords12 - a large ROM on a system connected at low
> > bandwidth just sufficient for defensive use but not for quickly
> > downloading the ROM.  (I don't have that paper reference handy at the
> > moment.  I may dig it up and post later, or Jeremy may.)

So I dug up whatever I had on this now, as above.


Powered by blists - more mailing lists