Re: [Cfrg] Balloon-Hashing or Argon2i.

[Bill Cox <[e-mail]>]

On Sun, Aug 14, 2016 at 11:17 PM, Stefano Tessaro <[e-mail]>
wrote:

>
> Concretely, for memory hardness, I think there are two questions:
>
> = Are the metrics in the [AB16] attacks realistic or not? If not
> (which seems to be the claim), can we state precise metrics that would
> be appealing to practitioners and that theoreticians can work with?


Correct, I do claim they are unrealistic.  I like their quality measure:
total energy.  The problem is their model was simplified too much.  In
particular:

1) The energy in DRAM is dominated by the high-speed interface
<http://people.duke.edu/~bcl15/documents/malladi2012-micro.pdf>.  Adding
additional size to the DRAM increases power slightly, and not at all
proportionally.  Storing data in a tiny capacitor continues to be super
efficient in terms of power in general.

2) There was no model for the power required for parallel cores to
communicate between them, and as a die gets large (they assumed up to
500mm^2), this power will dominate in their attack.

The right approach to analyzing ASIC attacks is to iterate with the ASIC
design community.  Every new model is an advance, but to make them more
effective we need to adapt them to make them more realistic.

I strongly agree with Jean-Philippe Aumasson above.  Any theoretical notion
of security needs to be tested fleshed out and tested in more realistic
attacks.  Any realistic ASIC attack will have to specify H.  We'll hear
about how the attacker takes advantage of deep pipelining and interleaving
to do multiple attacks in parallel more efficiently.  We'll hear about
custom cache architectures.  We'll also hear about exactly how data will
get routed between cores, and all of these various components will have
size and power estimates.

I have worked with ASICs for many years, but I do not consider myself a
world-class expert in ASIC design, nor am I familiar with changes in ASIC
design in the age of fin-fets.  However, I would be happy to help flesh out
more realistic attacks for anyone who wants to see how their model might
work in a real ASIC attack.

Bill