{"date_updated":"2021-01-12T08:07:53Z","publication_identifier":{"isbn":["9781450349468"]},"month":"10","day":"30","publication":"Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security","author":[{"full_name":"Alwen, Joel F","id":"2A8DFA8C-F248-11E8-B48F-1D18A9856A87","first_name":"Joel F","last_name":"Alwen"},{"full_name":"Blocki, Jeremiah","last_name":"Blocki","first_name":"Jeremiah"},{"last_name":"Harsha","first_name":"Ben","full_name":"Harsha, Ben"}],"page":"1001-1017","doi":"10.1145/3133956.3134031","type":"conference","main_file_link":[{"url":"https://eprint.iacr.org/2017/443","open_access":"1"}],"abstract":[{"text":"A memory-hard function (MHF) ƒn with parameter n can be computed in sequential time and space n. Simultaneously, a high amortized parallel area-time complexity (aAT) is incurred per evaluation. In practice, MHFs are used to limit the rate at which an adversary (using a custom computational device) can evaluate a security sensitive function that still occasionally needs to be evaluated by honest users (using an off-the-shelf general purpose device). The most prevalent examples of such sensitive functions are Key Derivation Functions (KDFs) and password hashing algorithms where rate limits help mitigate off-line dictionary attacks. As the honest users' inputs to these functions are often (low-entropy) passwords special attention is given to a class of side-channel resistant MHFs called iMHFs.\r\n\r\nEssentially all iMHFs can be viewed as some mode of operation (making n calls to some round function) given by a directed acyclic graph (DAG) with very low indegree. Recently, a combinatorial property of a DAG has been identified (called \"depth-robustness\") which results in good provable security for an iMHF based on that DAG. Depth-robust DAGs have also proven useful in other cryptographic applications. Unfortunately, up till now, all known very depth-robust DAGs are impractically complicated and little is known about their exact (i.e. non-asymptotic) depth-robustness both in theory and in practice.\r\n\r\nIn this work we build and analyze (both formally and empirically) several exceedingly simple and efficient to navigate practical DAGs for use in iMHFs and other applications. For each DAG we:\r\n*Prove that their depth-robustness is asymptotically maximal.\r\n*Prove bounds of at least 3 orders of magnitude better on their exact depth-robustness compared to known bounds for other practical iMHF.\r\n*Implement and empirically evaluate their depth-robustness and aAT against a variety of state-of-the art (and several new) depth-reduction and low aAT attacks. \r\nWe find that, against all attacks, the new DAGs perform significantly better in practice than Argon2i, the most widely deployed iMHF in practice.\r\n\r\nAlong the way we also improve the best known empirical attacks on the aAT of Argon2i by implementing and testing several heuristic versions of a (hitherto purely theoretical) depth-reduction attack. Finally, we demonstrate practicality of our constructions by modifying the Argon2i code base to use one of the new high aAT DAGs. Experimental benchmarks on a standard off-the-shelf CPU show that the new modifications do not adversely affect the impressive throughput of Argon2i (despite seemingly enjoying significantly higher aAT).\r\n","lang":"eng"}],"_id":"6527","language":[{"iso":"eng"}],"department":[{"_id":"KrPi"}],"conference":{"end_date":"2017-11-03","location":"Dallas, TX, USA","name":"CCS: Conference on Computer and Communications Security","start_date":"2017-10-30"},"publication_status":"published","citation":{"ista":"Alwen JF, Blocki J, Harsha B. 2017. Practical graphs for optimal side-channel resistant memory-hard functions. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. CCS: Conference on Computer and Communications Security, 1001–1017.","apa":"Alwen, J. F., Blocki, J., &#38; Harsha, B. (2017). Practical graphs for optimal side-channel resistant memory-hard functions. In <i>Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security</i> (pp. 1001–1017). Dallas, TX, USA: ACM Press. <a href=\"https://doi.org/10.1145/3133956.3134031\">https://doi.org/10.1145/3133956.3134031</a>","chicago":"Alwen, Joel F, Jeremiah Blocki, and Ben Harsha. “Practical Graphs for Optimal Side-Channel Resistant Memory-Hard Functions.” In <i>Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security</i>, 1001–17. ACM Press, 2017. <a href=\"https://doi.org/10.1145/3133956.3134031\">https://doi.org/10.1145/3133956.3134031</a>.","ama":"Alwen JF, Blocki J, Harsha B. Practical graphs for optimal side-channel resistant memory-hard functions. In: <i>Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security</i>. ACM Press; 2017:1001-1017. doi:<a href=\"https://doi.org/10.1145/3133956.3134031\">10.1145/3133956.3134031</a>","short":"J.F. Alwen, J. Blocki, B. Harsha, in:, Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, ACM Press, 2017, pp. 1001–1017.","mla":"Alwen, Joel F., et al. “Practical Graphs for Optimal Side-Channel Resistant Memory-Hard Functions.” <i>Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security</i>, ACM Press, 2017, pp. 1001–17, doi:<a href=\"https://doi.org/10.1145/3133956.3134031\">10.1145/3133956.3134031</a>.","ieee":"J. F. Alwen, J. Blocki, and B. Harsha, “Practical graphs for optimal side-channel resistant memory-hard functions,” in <i>Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security</i>, Dallas, TX, USA, 2017, pp. 1001–1017."},"date_published":"2017-10-30T00:00:00Z","ec_funded":1,"scopus_import":1,"year":"2017","publisher":"ACM Press","date_created":"2019-06-06T13:21:29Z","user_id":"2DF688A6-F248-11E8-B48F-1D18A9856A87","oa_version":"Submitted Version","oa":1,"project":[{"_id":"258AA5B2-B435-11E9-9278-68D0E5697425","name":"Teaching Old Crypto New Tricks","grant_number":"682815","call_identifier":"H2020"}],"status":"public","title":"Practical graphs for optimal side-channel resistant memory-hard functions","quality_controlled":"1"}