Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 30 Jun 2011 17:48:01 -0700
From: Colin Percival <>
To: Solar Designer <>
Subject: Re: scrypt time-memory tradeoff

On 06/30/11 17:39, Solar Designer wrote:
> Colin, all -
> This is probably nothing new to you, but here's some analysis Anthony
> Ferrara (ircmaxell) posted regarding an attacker making scrypt run in a
> lot less memory, by trading CPU/GPU time for that:

Yes... I think I explicitly mentioned that in my paper, in fact. ;-)

The design of scrypt puts a lower bound on the area-time product -- you can
use less memory and more CPU time, but the ratios stay within a constant
factor of each other, so for the worst-case attacker (ASICs) the cost per
password attempted stays the same.

I'm actually planning on adding this support to my scrypt code, in order to
avoid the "you don't have enough RAM to compute this hash" error; but I
haven't had the time yet.

Colin Percival
Security Officer, FreeBSD | | The power to serve
Founder / author, Tarsnap | | Online backups for the truly paranoid

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.