Re: [Cfrg] Security analysis of scrypt

[Paul Grubbs <[e-mail]>]

Interesting. Thanks for the explanation.

Just out of curiosity, can you explain in a little more detail *why* the
proof relies on data-dependency, and in what step your techniques would
fail if applied to something like Argon2i?
(This is mostly for my own interest, so feel free not to answer if it would
take too long)

On Wed, Feb 10, 2016 at 2:21 PM, Stefano Tessaro <[e-mail]>
wrote:

> > Can your results be extended to Argon2d and/or Argon2i? If so, are you
> > planning on doing it?
>
> Given the analysis is essentially about ROMix, it should extend to
> Argon2d. There are syntactical differences -- so we have been a bit
> cautious about making a final statement about Argon2d in the current
> preliminary version, beyond a footnote stating essentially what I am
> writing here -- but we are planning to make explicit what is the
> strongest statement about Argon2d we can get out of our techniques.
>
> However, what is clear is that the results do not extend to Argon2i.
> The point of this work was to focus on data-dependent designs, which
> were not covered by the techniques from the paper of Alwen and
> Serbinenko. The lower bound proof inherently relies on the
> construction being data dependent, and there is no obvious way to
> adapt it to something like Argon2i.
>
> Stefano
>