Reference : Tradeoff Cryptanalysis of Memory-Hard Functions
 Document type : Scientific congresses, symposiums and conference proceedings : Paper published in a book Discipline(s) : Engineering, computing & technology : Computer science To cite this reference: http://hdl.handle.net/10993/20043
 Title : Tradeoff Cryptanalysis of Memory-Hard Functions Language : English Author, co-author : Biryukov, Alex [University of Luxembourg > Faculty of Science, Technology and Communication (FSTC) > Computer Science and Communications Research Unit (CSC) > ; University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT)] Khovratovich, Dmitry [University of Luxembourg > Faculty of Science, Technology and Communication (FSTC) > Computer Science and Communications Research Unit (CSC) >] Publication date : Dec-2015 Main document title : 21st International Conference on the Theory and Application of Cryptology and Information Security Publisher : Springer Collection and collection volume : Springer LNCS 9452: ASIACRYPT 2015 Peer reviewed : Yes ISBN : 978-3-662-48799-0 Event name : Advances in Cryptology - ASIACRYPT 2015 Event date : November 29 - December 3, 2015 Event place (city) : Auckland Event country : New Zealand Abstract : [en] We explore time-memory and other tradeoffs for memory-hard functions, which are supposed to impose significant computational and time penalties if less memory is used than intended. We analyze two schemes: Catena, which has been presented at Asiacrypt 2014, and Lyra2, the fastest finalist of the Password Hashing Competition (PHC). We demonstrate that Catena's proof of tradeoff resilience is flawed, and attack it with a novel \emph{precomputation tradeoff}. We show that using $M^{2/3}$ memory instead of $M$ we may have no time penalties. We further generalize our method for a wide class of schemes with predictable memory access. For Lyra2, which addresses memory unpredictability (depending on the input), we develop a novel \emph{ranking tradeoff} and show how to decrease the time-memory and the time-area product by significant factors. We also generalize the ranking method for a wide class of schemes with unpredictable memory access Permalink : http://hdl.handle.net/10993/20043

File(s) associated to this reference

Fulltext file(s):

FileCommentaryVersionSizeAccess
Open access