Re: [Cfrg] [MASSMAIL]Re: adopting Argon2 as a CFRG document

["Paterson, Kenny" <[e-mail]>]

Dear Dmitry,

Please proceed by uploading a new draft as soon as it is ready.

We can certainly give you some speaking time to update us at the CFRG
meeting in Berlin. This will be very helpful indeed.

I should emphasise, of course, that what you may consider to the be the
"final draft" may still be deemed to require further work after review by
the group. That's how it works in IRTF/IETF.

Regards,

Kenny 

On 15/06/2016 15:42, "Cfrg on behalf of Dmitry Khovratovich"
<[e-mail] on behalf of [e-mail]> wrote:

>Dear chairs and others,
>
>we would like to proceed with the Argon2 draft unless there are strong
>objections. We have expanded the security section of the document to
>inform the user of the potential time-memory tradeoffs given the recent
>analysis papers.
> "Paranoid" parameter sets have been recommended as well. The final draft
>would then be presented in Berlin.
>
>
>
>Best regards,
>the Argon2 team.
>
>
>On Sat, May 21, 2016 at 10:38 AM, Dmitry Khovratovich
><[e-mail]> wrote:
>
>Some clarifications due to the increased attention to the paper by Alwen
>and Blocki, which has been presented at the recent Eurocrypt CFRG meeting.
>
>
>1. One of security parameters of memory-hard password hashing functions
>is how much an ASIC attacker can reduce the area-time product (AT) of a
>password cracker implemented on ASIC. The AT is conjectured to be
>proportional to the amortized cracking cost
> per password.
>
>
>2. The memory-hard functions with input-independent memory access (such
>as Argon2i) have been known for its relatively larger AT-reduction factor
>compared to functions with input-dependent memory access (such as
>Argon2d). To mitigate this, the minimum
> of 3 passes over memory for Argon2i was set.
>
>
>3. The best attacks on Argon2, published in the original design document
>in early 2015, have factor 1.3 for Argon2d and factor 3 for Argon2i.
>
>
>4. The best attack found by Alwen and Blocki has factor 2 for Argon2i.
>
>
>5. In a bit more details, the advantage of the Alwen-Blocki attack is
>upper bounded by (M^{1/4})/36, where M is the number of kilobytes used by
>Argon2i. Thus the attack has factor 2 with memory up to 16 GB, and less
>than 1 for memory up to 1 GB. Details
> in Section 5.6 of
>https://www.cryptolux.org/images/0/0d/Argon2.pdf
><https://www.cryptolux.org/images/0/0d/Argon2.pdf>
>
>
>Best regards,
>Argon2 team
>
>
>On Mon, Feb 1, 2016 at 10:06 PM, Dmitry Khovratovich
><[e-mail]> wrote:
>
>Dear all,
>
>
>as explained in a recent email
>http://article.gmane.org/gmane.comp.security.phc/3606 , we are fully
>aware of the analysis of Argon2i made by Corrigan-Gibbs et al. , we
> know how to mitigate the demonstrated effect, and have already made some
>benchmarks on the patch.
>
>
>Soon after the Crypto deadline (Feb-9) we will develop a new release
>including code, rationale, and test vectors.
>
>
>-- 
>Best regards,
>the Argon2 team.
>
>
>
>
>
>
>
>
>
>
>
>
>-- 
>Best regards,
>Dmitry Khovratovich
>
>
>
>
>
>
>
>
>
>-- 
>Best regards,
>Dmitry Khovratovich
>
>