[<prev] [day] [month] [year] [list]
Message-ID: <20210120215006.GA4368@openwall.com>
Date: Wed, 20 Jan 2021 22:50:06 +0100
From: Solar Designer <solar@...nwall.com>
To: crypt-dev@...ts.openwall.com
Subject: stateful per-block function vs. attacks on data-independent indexing
Hi,
(I tried posting this to the PHC discussions list, but the message
didn't appear anywhere nor bounced yet. JP says he's "not sure it's
still up and if anyone is registered". So going with crypt-dev.)
I don't recall us discussing this before (did we?) -
How does possible statefulness of a block processing function (such as
of a replacement of scrypt's BlockMix) affect TMTO attacks on
data-independent addressing (such as in a cache timing safe replacement
of scrypt's SMix)? Has this been researched at all?
Maybe having that function maintain and update enough internal state per
block is a better defense against TMTO on data-independent addressing
than having to require a larger minimum number of iterations over the
data (like we had to suggest e.g. for Argon2i). Or maybe a hybrid
approach works best (allowing for fewer iterations over the data).
For example, yescrypt's BlockMix writes several times more data to its
pwxform S-boxes than to the output block. I initially intended this
against pipelining attacks on sub-blocks (which we did discuss), but
perhaps it's also effective against TMTO attacks on a (potential future)
revision of yescrypt with data-independent addressing?
(Yes, for yescrypt the data-independent addressing would have to be for
the S-boxes too, or it wouldn't become fully cache timing safe. That's
a separate issue.)
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
