Subject: Re: [Cfrg] adopting Argon2 as a CFRG document

From: "Paterson, Kenny" <[email-masked]>
Date: Fri, 22 Jan 2016 19:10:48 +0000

Dear CFRG,

Having received limited feedback either way from the group (specifically,
one voice in favour), the CFRG chairs have decided to adopt
https://tools.ietf.org/html/draft-josefsson-argon2-00 as a CFRG document.

If you have objections or concerns, please reply to this email or directly
to CFRG chairs.

Sincerely,

Kenny Paterson (for the chairs)

On 06/11/2015 11:47, "Paterson, Kenny" <[email-masked]> wrote:

>Hi Stephen,
>
>Yes, the chairs are amenable to this. We've been keeping an eye on the
>password hashing competition and were planning a work item in this area.
>
>Any comments from the group, either supporting or objecting to us adopting
>this draft in the RG?
>
>Cheers,
>
>Kenny 
>
>(for the chairs)
>
>On 06/11/2015 02:18, "Cfrg on behalf of Stephen Farrell"
><[email-masked] on behalf of [email-masked]> wrote:
>
>>
>>The password hashing competition has a winner and some folks
>>in the openpgp wg are interested in using that winner. I guess
>>this might be better processed via cfrg if folks are amenable
>>to that.
>>
>>Thanks,
>>S.

---

From: Mike Hamburg <[email-masked]>
Date: Fri, 22 Jan 2016 11:20:46 -0800

We might want to hold off on Argon2 — at least on finalizing it — until the team has
responded to (and hopefully mitigated) the issues mentioned at
https://eprint.iacr.org/2016/027 <https://eprint.iacr.org/2016/027>.  Essentially the problem is that Argon2 can be computed
in less space than advertised.  The team said that they are planning a response, cf
http://permalink.gmane.org/gmane.comp.security.phc/3606 <http://permalink.gmane.org/gmane.comp.security.phc/3606>

Cheers,
— Mike

> On Jan 22, 2016, at 11:10 AM, Paterson, Kenny <[email-masked]> wrote:
> 
> Dear CFRG,
> 
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/cfrg

---

From: "Paterson, Kenny" <[email-masked]>
Date: Fri, 22 Jan 2016 19:30:20 +0000

Mike,

Thanks. The authors of the Argon2 design may in due course tweak their
design to avoid the identified problems, or argue that they are not
sufficiently worrisome to warrant a change to the design.

We definitely need to factor this in to our deliberations, and we will
take the time to do so. Let's see how it plays out...

Regards

Kenny

On 22/01/2016 19:20, "Mike Hamburg" <[email-masked]> wrote:

>https://eprint.iacr.org/2016/027.  Essentially the problem is that Argon2
>can be computed
>http://permalink.gmane.org/gmane.comp.security.phc/3606
>
>
>Cheers,
>— Mike
>
>

---

From: "Grigory Marshalko" <[email-masked]>
Date: Thu, 28 Jan 2016 20:39:02 +0000

Indeed, the PHC competition has significantly contributed to the design and analysis of password-hashing schemes. It's a nice mixture of crypto and engineering. So it would be desirable to wait until we understand the limits of attacks and corresponding countermeasures. 
The article on baloon hashing is a significant step forward for understanding these issues.

Regards,
Grigory Marshalko,
expert,
Technical committee for standardisation "Cryptography and security mechanisms" (ТC 26)
www.tc26.ru

---

From: Paul Grubbs <[email-masked]>
Date: Thu, 28 Jan 2016 16:53:10 -0500

Would it be out of the question to ask the authors of Argon2 (or anybody,
really) to do a more formal analysis of its space-hardness? It would be
nice to have a proof (e.g. based on pebbling arguments) of some kind of
time-space tradeoff for Argon2.

On Thu, Jan 28, 2016 at 3:39 PM, Grigory Marshalko <[email-masked]>
wrote:

> Indeed, the PHC competition has significantly contributed to the design
> and analysis of password-hashing schemes. It's a nice mixture of crypto and
> engineering. So it would be desirable to wait until we understand the
> limits of attacks and corresponding countermeasures.
> >> On Jan 22, 2016, at 11:10 AM, Paterson, Kenny <
> [email-masked]>
> >> wrote:
> >>
> >> Dear CFRG,
> >>

---

From: Mike Hamburg <[email-masked]>
Date: Thu, 28 Jan 2016 14:04:59 -0800

Argon2d avoids this problem (hopefully but not provably?). But I believe the concern with argon2d is that it may leak information through memory accesses, for example through the cache timing channel.

-- Mike

Sent from my phone.  Please excuse brevity and typos.

> On Jan 24, 2016, at 14:14, Gregory Disney-Leugers <[email-masked]> wrote:
> 
> Isn’t the mitigation to use Argon2d over Argon2i?
> 
> From: Cfrg <[email-masked]> on behalf of Mike Hamburg <[email-masked]>
> Date: Friday, January 22, 2016 at 11:20 AM
> To: "Paterson, Kenny" <[email-masked]>
> Cc: "[email-masked]" <[email-masked]>
> Subject: Re: [Cfrg] adopting Argon2 as a CFRG document
> Resent-From: Mark Baushke <[email-masked]>
> Resent-To: Gregory Disney-Leugers <[email-masked]>
> Resent-Date: Friday, January 22, 2016 at 11:26 AM
> 
> https://eprint.iacr.org/2016/027.  Essentially the problem is that Argon2 can be computed

---

From: [email-masked]
Date: Fri, 29 Jan 2016 06:34:32 +0300

I believe that we would see a sort of response to this challenge from argon suthors soon. It is quite natural to adjust security proofs yo the new techniques
Cheers,
Grigory
--
Отправлено из Mail.Ru для Android пятница, 29 января 2016г., 00:53 +0300 от Paul Grubbs < [email-masked]> :

>Would it be out of the question to ask the authors of Argon2 (or anybody, really) to do a more formal analysis of its space-hardness? It would be nice to have a proof (e.g. based on pebbling arguments) of some kind of time-space tradeoff for Argon2. 
>
>On Thu, Jan 28, 2016 at 3:39 PM, Grigory Marshalko  < [email-masked] > wrote:
>>22 января 2016 г., 22:31, "Paterson, Kenny" < [email-masked] > написал:
>>> Mike,
>>>
>>> On 22/01/2016 19:20, "Mike Hamburg" < [email-masked] > wrote:
>>>
>>>>  https://eprint.iacr.org/2016/027 . Essentially the problem is that Argon2
>>>> can be computed
>>>> On Jan 22, 2016, at 11:10 AM, Paterson, Kenny < [email-masked] >
>>>> wrote:
>>>>
>>>> Dear CFRG,
>>>>
>>>> On 06/11/2015 11:47, "Paterson, Kenny" < [email-masked] > wrote:
>>>>
>>>> Hi Stephen,
>>>>
>>>> < [email-masked] on behalf of
>>>>  [email-masked] > wrote:
>>>>

---

From: "Paterson, Kenny" <[email-masked]>
Date: Fri, 29 Jan 2016 13:30:44 +0000

Hi Paul, everyone,

I think there's general consensus here that we'd like the Argon2 team to
respond to the attacks as part of the CFRG process - and I am sure they'll
be doing so anyway for a wider audience. The chairs will reach out to the
team and find out what their plans are.

Regards

Kenny

On 28/01/2016 21:53, "Paul Grubbs" <[email-masked]> wrote:

>On Thu, Jan 28, 2016 at 3:39 PM, Grigory Marshalko
><[email-masked]> wrote:
>
>and analysis of password-hashing schemes. It's a nice mixture of crypto
>and engineering. So it would be desirable to wait until we understand the
>www.tc26.ru <http://www.tc26.ru>
><http://permalink.gmane.org/gmane.comp.security.phc/3606>
>>>
>>> Cheers,
>>> — Mike
>>>
>>> On Jan 22, 2016, at 11:10 AM, Paterson, Kenny
>>><[email-masked]>
>>> wrote:
>>>
>>> Dear CFRG,
>>>
>https://tools.ietf.org/html/draft-josefsson-argon2-00
><https://tools.ietf.org/html/draft-josefsson-argon2-00> as a CFRG
>document.
>>>
><https://www.irtf.org/mailman/listinfo/cfrg>
>>
><https://www.irtf.org/mailman/listinfo/cfrg>
>