<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">On Wed, 16 Jul 2014 16:48 John Kelsey wrote:<div><br></div><div><blockquote type="cite"><blockquote type="cite">On Jul 15, 2014, at 1:17 AM, "L. M. Goodman" <<a href="mailto:lmgoodman@hushmail.com">lmgoodman@hushmail.com</a>> wrote:<br></blockquote>...<br><blockquote type="cite">Fancy proof-of-work functions are a band-aid for a broken leg.<br></blockquote><br>This is kind-of how I think about most of the clever new ways of building better password hashing functions. There's often a lot of cleverness involved in making a provably memory-bound function, or a function that's got other nice guarantees that make it unlikely to be sped up much by using a bunch of graphics processors on your machine or something. But ultimately, using passwords to derive cryptographic keys is such an ugly problem that even the best of these schemes are, as you said, a band-aid for a broken leg. <br></blockquote><br></div><div>Much of the worlds security still depends on passwords (or pass phrases) and there are use cases where deriving cryptographic keys from a memorized secret is inescapable. How does an individual do meaningful disk encryption without deriving a key from a password? How does a reporter or aid worker bring a key across a border at which they expect to be throughly searched? </div><div><br></div><div>There is an arms race between people who wish to keep secrets and people who want to pry them lose. The latter got a huge boost with general purpose GPUs, to the point where the longest passwords that most people feel comfortable remembering can be easily if secured by standard cryptographic hashes. These were all designed to be fast in software and even faster in hardware, exactly the wrong criteria for a password hash. Users typically have a substantial amount of processing power and memory at their disposal, whether on a PC or on a smart phone. That processing power may not match the power available to many attackers, but if used properly it can restore a balance to a large extent. (I started preaching this concept 15 years ago <a href="http://world.std.com/~reinhold/HEKSproposal.html">http://world.std.com/~reinhold/HEKSproposal.html</a>)</div><div><br></div><div>For those of us in a world where even the most sophisticated organizations are limping on broken security legs, memory-bound functions designed to be unimplementable on graphics processors are more like an modern air-cast than a band-aid: they can put us back on our feet and help heal the breaks. </div><div><br></div><div>Arnold Reinhold</div><div><br></div></body></html>