phc-discussions - Re: [PHC] Argon2 improvement thread

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGiyFddbE36UkzM1Y7CDZ-ojgUKy1ryiqpzzOzwhy=6d3xNFNA@mail.gmail.com>
Date: Wed, 22 Jul 2015 06:43:40 +0000
From: Jean-Philippe Aumasson <jeanphilippe.aumasson@...il.com>
To: "discussions@...sword-hashing.net" <discussions@...sword-hashing.net>
Subject: Re: [PHC] Argon2 improvement thread

Set up a working document to keep track of the proposed changes and of
their status:
https://docs.google.com/document/d/1AHAZaA6yU8xFXA1bBoqKTbgWiY0jItNnkXV2cR9_Bcg/edit?usp=sharing

Please feel free to edit and to add (signed) comments.


On Tue, Jul 21, 2015 at 11:21 PM Bill Cox <waywardgeek@...il.com> wrote:

> On Tue, Jul 21, 2015 at 1:32 PM, Gregory Maxwell <gmaxwell@...il.com>
> wrote:
>
>> On Tue, Jul 21, 2015 at 7:45 PM, Solar Designer <solar@...nwall.com>
>> wrote:
>> > On Tue, Jul 21, 2015 at 12:24:00PM -0700, Bill Cox wrote:
>> >> If Alexander proposed to integrate his PWXFORM (I don't know what
>> MAXFORM
>> >> is), then I would be for it.  This would satisfy my request for
>> improved
>> >> GPU resistance, and also my request for multiplication-chain
>> computation
>> >> time hardening.
>> >
>> > MAXFORM is the scalar equivalent to (and subset of) pwxform.  It's
>> > neither parallel, nor wide, but is otherwise the same.
>> >
>> > It would co-exist with Argon2's existing SIMD code.
>>
>> Just to be clear--
>>
>> By existing SIMD code you mean the compression function that includes
>> the BlaMka permutation from Lyra2?
>>
>> E.g. You'd run the MAXFORM in parallel using the otherwise untilized
>> scalar multipliers concurrently with the existing (modified blake2
>> based) SIMD?
>>
>> I consider it a virtue to leave no computational resource available to
>> the defender idle...
>>
>
> Yes, that's what he means.  It might make sense to back off to the
> previous reduced-Blake2 if the multiplication chains are already done in
> the scalar unit.
>
> I agree it's better to use more of the defender's resources.
>
> Bill
>

Content of type "text/html" skipped