Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 18 Nov 2012 03:25:10 -0800
From: Colin Percival <>
To: Solar Designer <>
Subject: Re: scrypt time-memory tradeoff

On 11/18/12 03:19, Solar Designer wrote:
> On Sun, Nov 18, 2012 at 03:07:54AM -0800, Colin Percival wrote:
>> This is correct, and gives you asymptotically a 2x reduction in area-time
>> cost during the second phase.
> Yes, but that's 4x for scrypt overall.

Right, by ignoring the setup phase.

>> Which falls within the definition of "constant
>> factor", and was taken into account in the cost estimates in the paper.
> Was it?  That's good news.  IIRC, when I tried repeating your cost
> calculations ~2 years ago, I managed to arrive at numbers in your paper
> without taking this trade-off into account.  So it must be one of: I
> made an error back then, I do not recall correctly, or you did not
> actually take this into account.  Should we verify those numbers now?

I was certainly aware of these factors, and intended to take them into account
in my estimates.  But I'm not so brave as to claim that I definitely didn't
lose a factor of 2 when I was doing my calculations. :-)

Colin Percival
Security Officer Emeritus, FreeBSD | The power to serve
Founder, Tarsnap | | Online backups for the truly paranoid

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.