Re: [Cfrg] Security analysis of scrypt

[Stefano Tessaro <[e-mail]>]

> Can your results be extended to Argon2d and/or Argon2i? If so, are you
> planning on doing it?

Given the analysis is essentially about ROMix, it should extend to
Argon2d. There are syntactical differences -- so we have been a bit
cautious about making a final statement about Argon2d in the current
preliminary version, beyond a footnote stating essentially what I am
writing here -- but we are planning to make explicit what is the
strongest statement about Argon2d we can get out of our techniques.

However, what is clear is that the results do not extend to Argon2i.
The point of this work was to focus on data-dependent designs, which
were not covered by the techniques from the paper of Alwen and
Serbinenko. The lower bound proof inherently relies on the
construction being data dependent, and there is no obvious way to
adapt it to something like Argon2i.

Stefano