Date: Sun, 18 Nov 2012 03:23:31 -0800 From: Colin Percival <cperciva@...snap.com> To: Solar Designer <solar@...nwall.com> CC: scrypt@...snap.com, crypt-dev@...ts.openwall.com Subject: Re: scrypt time-memory tradeoff On 11/17/12 02:53, Solar Designer wrote: > On Sat, Nov 17, 2012 at 05:20:54AM +0400, Solar Designer wrote: >> Thus, we have halved our memory needs (circuit area) and paid for this >> by only a 25% increase in processing time. >> >> Now, if we want to reduce our memory needs a lot more, the situation is >> a lot better (for the defender). > > Actually, unless I am mistaken, the area-time product is asymptotically > (by making extreme use of this trade-off) only 25% of what's expected in > the scrypt paper. You get a 2x cost reduction by trading increased time for reduced area (as in a previous email) and another 2x reduction by ignoring the initial setup (practically speaking) but I never intended to include the setup in my area-time bound. -- Colin Percival Security Officer Emeritus, FreeBSD | The power to serve Founder, Tarsnap | www.tarsnap.com | Online backups for the truly paranoid
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.