Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 18 Nov 2012 03:25:10 -0800
From: Colin Percival <cperciva@...snap.com>
To: Solar Designer <solar@...nwall.com>
CC: scrypt@...snap.com, crypt-dev@...ts.openwall.com
Subject: Re: scrypt time-memory tradeoff

On 11/18/12 03:19, Solar Designer wrote:
> On Sun, Nov 18, 2012 at 03:07:54AM -0800, Colin Percival wrote:
>> This is correct, and gives you asymptotically a 2x reduction in area-time
>> cost during the second phase.
> 
> Yes, but that's 4x for scrypt overall.

Right, by ignoring the setup phase.

>> Which falls within the definition of "constant
>> factor", and was taken into account in the cost estimates in the paper.
> 
> Was it?  That's good news.  IIRC, when I tried repeating your cost
> calculations ~2 years ago, I managed to arrive at numbers in your paper
> without taking this trade-off into account.  So it must be one of: I
> made an error back then, I do not recall correctly, or you did not
> actually take this into account.  Should we verify those numbers now?

I was certainly aware of these factors, and intended to take them into account
in my estimates.  But I'm not so brave as to claim that I definitely didn't
lose a factor of 2 when I was doing my calculations. :-)

-- 
Colin Percival
Security Officer Emeritus, FreeBSD | The power to serve
Founder, Tarsnap | www.tarsnap.com | Online backups for the truly paranoid

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ