Date: Wed, 20 Jan 2021 22:50:06 +0100 From: Solar Designer <solar@...nwall.com> To: crypt-dev@...ts.openwall.com Subject: stateful per-block function vs. attacks on data-independent indexing Hi, (I tried posting this to the PHC discussions list, but the message didn't appear anywhere nor bounced yet. JP says he's "not sure it's still up and if anyone is registered". So going with crypt-dev.) I don't recall us discussing this before (did we?) - How does possible statefulness of a block processing function (such as of a replacement of scrypt's BlockMix) affect TMTO attacks on data-independent addressing (such as in a cache timing safe replacement of scrypt's SMix)? Has this been researched at all? Maybe having that function maintain and update enough internal state per block is a better defense against TMTO on data-independent addressing than having to require a larger minimum number of iterations over the data (like we had to suggest e.g. for Argon2i). Or maybe a hybrid approach works best (allowing for fewer iterations over the data). For example, yescrypt's BlockMix writes several times more data to its pwxform S-boxes than to the output block. I initially intended this against pipelining attacks on sub-blocks (which we did discuss), but perhaps it's also effective against TMTO attacks on a (potential future) revision of yescrypt with data-independent addressing? (Yes, for yescrypt the data-independent addressing would have to be for the S-boxes too, or it wouldn't become fully cache timing safe. That's a separate issue.) Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.