Re: [Cfrg] I-D Action: draft-irtf-cfrg-argon2-02.txt

Some comments on a new draft:Variants

Argon2 fills M bytes of memory in T iterations over it, with M and T being
the parameters supplied to Argon2 and determining its performance. Speed on
a typical server is linear in the MT product.

The Argon2 family has three variants: I, D, and ID, which differ in the way
of reusing memory that has been filled. The I variant makes queries with
predictable addresses, whereas D determines the addresses on the fly
depending on the current state (and thus the password). The ID variant
follows I for the first half of the memory used and D for the rest and
while overwriting.
Side-channels

The side-channel attacks, which are of still rising concern in the security
community, are applicable to the D variant as the memory addresses and thus
information about the password or other secret inputs can be determined
from the timing leaks. The I variant is completely invulnerable to this
attack, and the ID variant provides only a constant factor improvement for
the attacker.
Hardware and tradeoffs

The M and T parameters determine the cost of bruteforcing passwords on
custom hardware, which is proportional to M2T if we follow the traditional
time-area product metric. The time-memory tradeoff analysis [2] shows that
the bruteforce cost for the I variant can be changed to M2T/Q(M,T) for some
quality function Q. For instance, Q(230,1)=5, Q(230,4)=2.5.

The D variant is invulnerable to the approach [2], and the savings factor
in the ID variant is upper bounded by factor 2 for all parameters.
Defender tradeoff and ultimate recommendations

In public and private conversations with security architects in the
industry we learned that the bottleneck in a system employing the
password-hashing function is the function latency rather than memory costs.
We then assume that a rational defender would like to maximize the
bruteforce costs for the attacker equipped with a list of hashes, salts,
and timing information, for fixed computing time on the defender’s machine.
In this assumption the defender keeps the MT product constant and maximizes
the losses M/Q(M,T). The authors of [2] provides us with attack cost
estimates for constant MT = 228,230,232 (measured in iteration-bytes)

We ultimately recommend the ID variant with T=1 and maximum M as a default
setting for all environments, which is secure against side-channel attacks
and prohibit adversarial advantage on dedicated bruteforce hardware.

References

[1] “Efficiently Computing Data-Independent Memory-Hard Functions”
<http://eprint.iacr.org/2016/115.pdf>

[2] “Towards Practical Attacks on Argon2i and Balloon Hashing”
<http://eprint.iacr.org/2016/759.pdf>

On Mon, Mar 27, 2017 at 12:46 PM, <internet-drafts@ietf.org> wrote:

>
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories.
> This draft is a work item of the Crypto Forum of the IETF.
>
>         Title           : The memory-hard Argon2 password hash and
> proof-of-work function
>         Authors         : Alex Biryukov
>                           Daniel Dinu
>                           Dmitry Khovratovich
>                           Simon Josefsson
>         Filename        : draft-irtf-cfrg-argon2-02.txt
>         Pages           : 26
>         Date            : 2017-03-27
>
> Abstract:
>    This document describes the Argon2 memory-hard function for password
>    hashing and proof-of-work applications.  We provide an implementer
>    oriented description together with sample code and test vectors.  The
>    purpose is to simplify adoption of Argon2 for Internet protocols.
>
>
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-irtf-cfrg-argon2/
>
> There are also htmlized versions available at:
> https://tools.ietf.org/html/draft-irtf-cfrg-argon2-02
> https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-argon2-02
>
> A diff from the previous version is available at:
> https://www.ietf.org/rfcdiff?url2=draft-irtf-cfrg-argon2-02
>
>
> Please note that it may take a couple of minutes from the time of
> submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@irtf.org
> https://www.irtf.org/mailman/listinfo/cfrg
>

-- 
Best regards,
Dmitry Khovratovich