Re: [Cfrg] I-D Action: draft-irtf-cfrg-argon2-02.txt

[Dmitry Khovratovich <[e-mail]>]

Dear Russ, Stanislav, Jeremiah,

thank you a lot for the efforts! The reviews make the document much better.
We are now working on integrating the comments into the draft, hopefully
finished next week.

We'll publish a document where every comment is accompanied with a note.

Best regards,
Dmitry, Alex

On Tue, Jul 4, 2017 at 4:06 PM, Paterson, Kenny <[e-mail]>
wrote:

> Dear Argon2 authors,
>
>
> You will have seen the two recent CFRG review panel reviews for
> draft-irtf-cfrg-argon2-02.txt:
>
> https://www.ietf.org/mail-archive/web/cfrg/current/msg09199.html
>
> https://www.ietf.org/mail-archive/web/cfrg/current/msg09195.html
>
>
> - thanks to Russ Housley and Stanislav Smyshlyaev for preparing these.
>
> Please would you take these reviews into account when preparing the next
> version of your draft? It would helpful if you would post a response
> explaining how you have addressed the comments when you are ready.
>
> (Note also that there was a cutoff for new drafts this Monday past because
> of the upcoming IETF meeting.)
>
> Regards
>
> Kenny (for the chairs)
>
>
> On 15/06/2017 15:16, "Paterson, Kenny" <[e-mail]> wrote:
>
> >Dear CFRG,
> >
> >Dmitry Khovratovich kindly presented the latest draft for Argon2 at the
> >interim CFRG meeting in Paris. For those of you who could not attend, his
> >slides can be found here:
> >
> >https://www.ietf.org/proceedings/interim-2017-cfrg-
> 01/slides/slides-interi
> >m
> >-2017-cfrg-01-sessa-argon2-00.pdf
> >
> >
> >My sense from the constructive discussion that took place after Dmitry's
> >talk in Paris was that there are now no remaining serious objections to
> >the recommended parameters in the latest version of the draft:
> >
> >https://datatracker.ietf.org/doc/draft-irtf-cfrg-argon2/
> >
> >
> >If there are further substantive technical comments from the CFRG
> >membership, the chairs would be grateful if they could be brought to the
> >list in the next few days.
> >
> >Assuming we have indeed reached consensus, then we will be in a position
> >to move to last call for this ID.
> >
> >Thanks,
> >
> >Kenny (for the chairs)
> >
> >
> >On 27/03/2017 11:51, "Cfrg on behalf of Dmitry Khovratovich"
> ><[e-mail] on behalf of [e-mail]> wrote:
> >
> >>Some comments on a new draft:VariantsArgon2 fills M bytes of memory in T
> >>iterations over
> >> it, with M and T being the parameters supplied to Argon2 and determining
> >>its performance. Speed on a typical server is linear in the MT product.
> >>
> >>The Argon2 family has three variants: I, D, and
> >> ID, which differ in the way of reusing memory that has been filled. The
> >>I variant makes queries with predictable addresses, whereas D determines
> >>the addresses on the fly depending on the current state (and thus the
> >>password). The ID variant follows I for the
> >> first half of the memory used and D for the rest and while overwriting.
> >>Side-channelsThe side-channel attacks, which are of still rising
> >> concern in the security community, are applicable to the D variant as
> >>the memory addresses and thus information about the password or other
> >>secret inputs can be determined from the timing leaks. The I variant is
> >>completely invulnerable to this attack, and
> >> the ID variant provides only a constant factor improvement for the
> >>attacker.
> >>Hardware and tradeoffsThe M and T parameters determine the cost of
> >>bruteforcing
> >> passwords on custom hardware, which is proportional to M2T
> >> if we follow the traditional time-area product metric. The time-memory
> >>tradeoff analysis [2] shows that the bruteforce cost for the I variant
> >>can be changed to M2T/Q(M,T)
> >> for some quality function Q. For instance, Q(230,1)=5,
> >> Q(230,4)=2.5.
> >>
> >>The D variant is invulnerable to the approach [2],
> >> and the savings factor in the ID variant is upper bounded by factor 2
> >>for all parameters.
> >>Defender tradeoff and ultimate
> >> recommendationsIn public and private conversations with security
> >> architects in the industry we learned that the bottleneck in a system
> >>employing the password-hashing function is the function latency rather
> >>than memory costs. We then assume that a rational defender would like to
> >>maximize the bruteforce costs for the attacker
> >> equipped with a list of hashes, salts, and timing information, for fixed
> >>computing time on the
> >> defender’s machine.  In this assumption the defender keeps the MT
> >>product constant and maximizes the losses M/Q(M,T).
> >> The authors of [2] provides us with attack cost estimates for constant
> >>MT = 228,230,232
> >> (measured in iteration-bytes)
> >>
> >>We ultimately recommend the ID variant with T=1 and maximum M as a
> >>default setting for all environments, which is secure
> >> against side-channel attacks and prohibit adversarial advantage on
> >>dedicated bruteforce hardware.
> >>
> >>
> >>References[1]
> >>“Efficiently Computing Data-Independent
> >> Memory-Hard Functions” <http://eprint.iacr.org/2016/115.pdf>
> >>[2]
> >>“Towards Practical Attacks on
> >> Argon2i and Balloon Hashing”  <http://eprint.iacr.org/2016/759.pdf>
> >>
> >>
> >>
> >>
> >>
> >>On Mon, Mar 27, 2017 at 12:46 PM, <[e-mail]> wrote:
> >>
> >>
> >>A New Internet-Draft is available from the on-line Internet-Drafts
> >>directories.
> >>This draft is a work item of the Crypto Forum of the IETF.
> >>
> >>        Title           : The memory-hard Argon2 password hash and
> >>proof-of-work function
> >>        Authors         : Alex Biryukov
> >>                          Daniel Dinu
> >>                          Dmitry Khovratovich
> >>                          Simon Josefsson
> >>        Filename        : draft-irtf-cfrg-argon2-02.txt
> >>        Pages           : 26
> >>        Date            : 2017-03-27
> >>
> >>Abstract:
> >>   This document describes the Argon2 memory-hard function for password
> >>   hashing and proof-of-work applications.  We provide an implementer
> >>   oriented description together with sample code and test vectors.  The
> >>   purpose is to simplify adoption of Argon2 for Internet protocols.
> >>
> >>
> >>The IETF datatracker status page for this draft is:
> >>https://datatracker.ietf.org/doc/draft-irtf-cfrg-argon2/
> >>
> >>There are also htmlized versions available at:
> >>https://tools.ietf.org/html/draft-irtf-cfrg-argon2-02
> >>https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-argon2-02
> >>
> >>A diff from the previous version is available at:
> >>https://www.ietf.org/rfcdiff?url2=draft-irtf-cfrg-argon2-02
> >>
> >>
> >>Please note that it may take a couple of minutes from the time of
> >>submission
> >>until the htmlized version and diff are available at
> >>tools.ietf.org <http://tools.ietf.org>.
> >>
> >>Internet-Drafts are also available by anonymous FTP at:
> >>ftp://ftp.ietf.org/internet-drafts/
> >>
> >>_______________________________________________
> >>Cfrg mailing list
> >>[e-mail]
> >>https://www.irtf.org/mailman/listinfo/cfrg
> >>
> >>
> >>
> >>
> >>
> >>
> >>
> >>--
> >>Best regards,
> >>Dmitry Khovratovich
> >>
> >>
> >
>
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> https://www.irtf.org/mailman/listinfo/cfrg
>



-- 
Best regards,
Dmitry Khovratovich