Subject: [Cfrg] I-D Action: draft-irtf-cfrg-argon2-02.txt

From: [email-masked]
Date: Mon, 27 Mar 2017 03:46:37 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Crypto Forum of the IETF.

        Title           : The memory-hard Argon2 password hash and proof-of-work function
        Authors         : Alex Biryukov
                          Daniel Dinu
                          Dmitry Khovratovich
                          Simon Josefsson
	Filename        : draft-irtf-cfrg-argon2-02.txt
	Pages           : 26
	Date            : 2017-03-27

Abstract:
   This document describes the Argon2 memory-hard function for password
   hashing and proof-of-work applications.  We provide an implementer
   oriented description together with sample code and test vectors.  The
   purpose is to simplify adoption of Argon2 for Internet protocols.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-irtf-cfrg-argon2/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-irtf-cfrg-argon2-02
https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-argon2-02

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-irtf-cfrg-argon2-02

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Dmitry Khovratovich <[email-masked]>
Date: Mon, 27 Mar 2017 12:51:17 +0200

Some comments on a new draft:Variants

Argon2 fills M bytes of memory in T iterations over it, with M and T being
the parameters supplied to Argon2 and determining its performance. Speed on
a typical server is linear in the MT product.

The Argon2 family has three variants: I, D, and ID, which differ in the way
of reusing memory that has been filled. The I variant makes queries with
predictable addresses, whereas D determines the addresses on the fly
depending on the current state (and thus the password). The ID variant
follows I for the first half of the memory used and D for the rest and
while overwriting.
Side-channels

The side-channel attacks, which are of still rising concern in the security
community, are applicable to the D variant as the memory addresses and thus
information about the password or other secret inputs can be determined
from the timing leaks. The I variant is completely invulnerable to this
attack, and the ID variant provides only a constant factor improvement for
the attacker.
Hardware and tradeoffs

The M and T parameters determine the cost of bruteforcing passwords on
custom hardware, which is proportional to M2T if we follow the traditional
time-area product metric. The time-memory tradeoff analysis [2] shows that
the bruteforce cost for the I variant can be changed to M2T/Q(M,T) for some
quality function Q. For instance, Q(230,1)=5, Q(230,4)=2.5.

The D variant is invulnerable to the approach [2], and the savings factor
in the ID variant is upper bounded by factor 2 for all parameters.
Defender tradeoff and ultimate recommendations

In public and private conversations with security architects in the
industry we learned that the bottleneck in a system employing the
password-hashing function is the function latency rather than memory costs.
We then assume that a rational defender would like to maximize the
bruteforce costs for the attacker equipped with a list of hashes, salts,
and timing information, for fixed computing time on the defender’s machine.
In this assumption the defender keeps the MT product constant and maximizes
the losses M/Q(M,T). The authors of [2] provides us with attack cost
estimates for constant MT = 228,230,232 (measured in iteration-bytes)

We ultimately recommend the ID variant with T=1 and maximum M as a default
setting for all environments, which is secure against side-channel attacks
and prohibit adversarial advantage on dedicated bruteforce hardware.

References

[1] “Efficiently Computing Data-Independent Memory-Hard Functions”
<http://eprint.iacr.org/2016/115.pdf>

[2] “Towards Practical Attacks on Argon2i and Balloon Hashing”
<http://eprint.iacr.org/2016/759.pdf>

On Mon, Mar 27, 2017 at 12:46 PM, <[email-masked]> wrote:

> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg
>

-- 
Best regards,
Dmitry Khovratovich