Re: scrypt time-memory tradeoff

[Colin Percival <cperciva@tarsnap.com>]

On 11/18/12 03:19, Solar Designer wrote:
> On Sun, Nov 18, 2012 at 03:07:54AM -0800, Colin Percival wrote:
>> This is correct, and gives you asymptotically a 2x reduction in area-time
>> cost during the second phase.
> 
> Yes, but that's 4x for scrypt overall.

Right, by ignoring the setup phase.

>> Which falls within the definition of "constant
>> factor", and was taken into account in the cost estimates in the paper.
> 
> Was it?  That's good news.  IIRC, when I tried repeating your cost
> calculations ~2 years ago, I managed to arrive at numbers in your paper
> without taking this trade-off into account.  So it must be one of: I
> made an error back then, I do not recall correctly, or you did not
> actually take this into account.  Should we verify those numbers now?

I was certainly aware of these factors, and intended to take them into account
in my estimates.  But I'm not so brave as to claim that I definitely didn't
lose a factor of 2 when I was doing my calculations. :-)

-- 
Colin Percival
Security Officer Emeritus, FreeBSD | The power to serve
Founder, Tarsnap | www.tarsnap.com | Online backups for the truly paranoid