2
Mathematical Proof that memory hardness is not reversible? (infosec.pub)
submitted 1 month ago by to c/crypto@infosec.pub
3 comments fedilink hide all child comments
 

Hello, i have a question. I understand that government institutions probably do not want to certify memoryhard KDFs like argon* (because government agencies cannot bruteforce for clandestine or forensic purporses) but sometimes i wonder, if there is actual mathematical proof, that memory hardness like done for argon, scrypt and co. cannot be reverse into more bruteforce with a timetradeoff.

Can anyone explain this to me, because i feel like i do not understand something?

you are viewing a single comment's thread
view the rest of the comments
[–] [S] 1 point 1 month ago (1 child)

huh, i think i know understand it better. it works that hashing steps builds on multiple hashing steps together from previous rounds, which increase storage consumption. but i still do not understand, why less storage consumption makes pbkdf2 for example faster to crack in fpga

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
  • [–] 1 point 2 weeks ago

    PBKDF2 is almost entirely "linear", you can build an efficient pipeline which runs entirely on-chip without needing to reach out to external memory (a very large RAM requirement needs many more state holding gates than the FPGA has available, so it needs to start using external memory). The FPGA can essentially compose a digital conveyor belt for PBKDF2. This isn't as effective for Argon2id which forces it to stop and start and stop and start, etc.

  • permalink
  • fedilink
  • source
  • parent