Re: scrypt time-memory tradeoff

[Colin Percival <cperciva@tarsnap.com>]

On 06/30/11 17:39, Solar Designer wrote:
> Colin, all -
> 
> This is probably nothing new to you, but here's some analysis Anthony
> Ferrara (ircmaxell) posted regarding an attacker making scrypt run in a
> lot less memory, by trading CPU/GPU time for that:

Yes... I think I explicitly mentioned that in my paper, in fact. ;-)

The design of scrypt puts a lower bound on the area-time product -- you can
use less memory and more CPU time, but the ratios stay within a constant
factor of each other, so for the worst-case attacker (ASICs) the cost per
password attempted stays the same.

I'm actually planning on adding this support to my scrypt code, in order to
avoid the "you don't have enough RAM to compute this hash" error; but I
haven't had the time yet.

-- 
Colin Percival
Security Officer, FreeBSD | freebsd.org | The power to serve
Founder / author, Tarsnap | tarsnap.com | Online backups for the truly paranoid