phc-discussions - Re: [PHC] patents

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 18 Jul 2015 21:28:05 +0300
From: Solar Designer <solar@...nwall.com>
To: discussions@...sword-hashing.net
Subject: Re: [PHC] patents

On Thu, Jul 16, 2015 at 11:23:59AM +0200, Dmitry Khovratovich wrote:
> That's sad. The MSR paper you mention is probably
> http://www.wisdom.weizmann.ac.il/~naor/PAPERS/mem.pdf

No, not that one.  And I actually recalled incorrectly.  Here's an
excerpt from an email Jeremy sent me in March 2015:

| Last December, I was reading a Microsoft Research paper, 'An
| Administrator's Guide to Internet Password Research' [1] and I noticed a
| footnote, 'Perfectly Secure Password Protocols in the Bounded Retrieval
| Model', for a paper published in 2006. A few days later I was searching
| for a link back to the paper, and stumbled upon their patent [2]. As soon
| as I learned about it, we filed a disclosure to the patent office to cited
| it as a reference. I'm not currently aware of any other patents in this
| space.
[...]
| [1] - http://research.microsoft.com/pubs/227130/WhatsaSysadminToDo.pdf
| [2] - http://www.google.com/patents/US20070180260

My sadness and anger aside, I appreciated this info.  Thanks, Jeremy.

I am sorry for directly posting an excerpt of a private email to a
public list, but I felt I had to make the info public anyway and I
wouldn't have worded it better.  I hope Jeremy understands and agrees.

So the recent MSR paper was merely referring to an older paper by other
authors.  I don't recall ever seeing the older paper itself, and I did
not read the patent, but I did read (after Jeremy's email in March) the
one-paragraph summary on page 11 in WhatsaSysadminToDo.pdf referenced
above.  It's reference [15] in there.

> On Thu, Jul 16, 2015 at 10:48 AM, Solar Designer <solar@...nwall.com> wrote:
> > The other patent, which I also haven't read closely, covers an idea
> > expressed in IIRC a Microsoft Research paper from several years ago.
> > In the paper, it's essentially the same idea Steve Thomas proposed
> > shortly before Passwords12 - a large ROM on a system connected at low
> > bandwidth just sufficient for defensive use but not for quickly
> > downloading the ROM.  (I don't have that paper reference handy at the
> > moment.  I may dig it up and post later, or Jeremy may.)

So I dug up whatever I had on this now, as above.

Alexander