phc-discussions - Re: [PHC] Re: Attack on Argon2i?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 12 Jan 2016 13:42:11 +0100
From: Dmitry Khovratovich <khovratovich@...il.com>
To: "discussions@...sword-hashing.net" <discussions@...sword-hashing.net>
Cc: Jean-Philippe Aumasson <jeanphilippe.aumasson@...il.com>
Subject: Re: [PHC] Re: Attack on Argon2i?

The authors basically propose to discard the blocks between their last use
and overwrite. This strategy allows to use less memory (by a small constant
factor), though I still have to check the exact factor value.

My main technical concern is in the analysis of the multi-pass Argon2i. The
authors compute the probability of each block to survive at _every_ step,
so that these probabilities accumulate over time whereas they should not. I
will double-check the details and report on them ASAP.

Dmitry Khovratovich

On Tue, Jan 12, 2016 at 10:43 AM, Simon Josefsson <simon@...efsson.org>
wrote:

> Jean-Philippe Aumasson <jeanphilippe.aumasson@...il.com> writes:
>
> > Appendix A claims a memory reduction on Argon2i:
> > http://eprint.iacr.org/2016/027
> >
> > Not clear to me what's the actual efficiency of the improved attack
> though.
>
> It says:
>
>    it is possible to compute the single-pass variant of the Argon2i
>    password hashing function [...] using between a quarter and a fifth
>    of the desired space with no computational penalty.
>
> The attack appears to require a pre-computation phase to pre-compute the
> time after which some blocks will not be needed any more, so they can be
> discarded during the computational phase, thus saving memory.
>
> So overall the computation appears is larger, and I'm not sure in which
> attack scenario this approach would actually be useful.
>
> /Simon
>

-- 
Best regards,
Dmitry Khovratovich

Content of type "text/html" skipped