Subject: Re: [Cfrg] scrypt password-based key derivation function

From: Stephen Farrell <[email-masked]>
Date: Thu, 10 Dec 2015 13:19:51 +0000

Hiya,

Just a heads-up that this is currently up for IESG approval
on the January 7th telechat. If someone had a chance to take
a peek in the meantime that'd be great as there were a few
changes and clarifications done but hopefully nothing bad:-)

Thanks,
S.

On 24/09/12 10:55, Simon Josefsson wrote:
> All,
> 
> Colin and I have published a draft describing Colin's scrypt key
> derivation function.  We would appreciate review of the document:
> 
> http://tools.ietf.org/html/draft-josefsson-scrypt-kdf
> 
> The input we are seeking here is primarily review of the cryptographic
> aspects and correctness of the algorithm description, although all
> comments and suggestions are appreciated.
> 
> Thanks in advance,
> /Simon
> _______________________________________________
> Cfrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/cfrg
>

---

From: Hanno Böck <[email-masked]>
Date: Thu, 10 Dec 2015 19:27:37 +0100

Hi,

On Thu, 10 Dec 2015 13:19:51 +0000

> changes and clarifications done but hopefully nothing bad:-)

I see that this was originally submitted in 2012.

These days we have argon2 and from what I'm aware scrypt and argon2
have very similar goals. However argon2 is the winner of a
competition.

So is it really appropriate to still have an rfc for scrypt? It seems
that whereever scrypt is considered to be used argon2 can replace it.
And having more choices with almost the same goals only adds unneeded
complexity.

-- 
Hanno Böck
http://hboeck.de/

mail/jabber: [email-masked]
GPG: BBB51E42

---

From: Aaron Zauner <[email-masked]>
Date: Thu, 10 Dec 2015 22:14:07 +0100

> have very similar goals. However argon2 is the winner of a

Haven't seen an I-D for an argon2 based PBKDF. yet.

Aaron

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Thu, 10 Dec 2015 16:29:13 -0500

> Haven't seen an I-D for an argon2 based PBKDF. yet.

I asked about this in Yokohama, and iirc, was told that Simon (who
started this thread) was looking into writing one.  Simon, is that the
case?

        --dkg

---

From: Björn Edström <[email-masked]>
Date: Thu, 10 Dec 2015 22:31:21 +0100

Seems to be in progress:
https://datatracker.ietf.org/doc/draft-josefsson-argon2/

On Thu, Dec 10, 2015 at 10:14 PM, Aaron Zauner <[email-masked]> wrote:
> https://www.irtf.org/mailman/listinfo/cfrg
>

---

From: Aaron Zauner <[email-masked]>
Date: Thu, 10 Dec 2015 23:10:57 +0100

> https://datatracker.ietf.org/doc/draft-josefsson-argon2/

This I-D is for argon2 itself, not an argon2 based PBKDF. Or am I
missing something?

Aaron

---

From: Simon Josefsson <[email-masked]>
Date: Fri, 11 Dec 2015 11:22:59 +0100

> And having more choices with almost the same goals only adds unneeded

At this point, publishing the scrypt document is about documenting
reality.  Scrypt is already widely deployed used on the Internet.  That
is why I believe it is useful to publish this.  I agree it is better to
promote Argon2 going forward -- and that work is in progress -- but I
believe there will be years until it reaches the same deployment level
as scrypt.  Argon2 was finalized only on the last months.

/Simon

---

From: Simon Josefsson <[email-masked]>
Date: Fri, 11 Dec 2015 11:26:08 +0100

> This I-D is for argon2 itself, not an argon2 based PBKDF. Or am I

I may be missing something -- what do you mean with "argon2 based
PBKDF"?  Argon2 IS a pbkdf, for all definitions of a pbkdf that I am
aware of.

Are you looking for an ASN.1 schema and OID, similar to the one found in
the scrypt document?  Then I understand, and agree, and it should be
part of the next version of draft-josefsson-argon2.

/Simon

---

From: Aaron Zauner <[email-masked]>
Date: Sat, 12 Dec 2015 16:07:24 +0100

> part of the next version of draft-josefsson-argon2.

Nah, I totally got that wrong. Mea culpa - should have read the whole
document first and not post when overly tired :)

Aaron

---

From: Tony Arcieri <[email-masked]>
Date: Sat, 12 Dec 2015 16:50:19 -0800

> as scrypt.  Argon2 was finalized only on the last months.

+1

As a PHC judge: scrypt is still a fine choice, and while I think Argon2
will be a great choice in the future, scrypt has a much better ecosystem of
supported implementations, documentation, etc

-- 
Tony Arcieri

---

From: Björn Edström <[email-masked]>
Date: Sun, 13 Dec 2015 12:51:28 +0100

Case in point: Cisco IOS (as run by routers etc) supports scrypt. It
will live on for a while.

Cheers
Björn

On Sun, Dec 13, 2015 at 1:50 AM, Tony Arcieri <[email-masked]> wrote:
> As a PHC judge: scrypt is still a fine choice, and while I think Argon2 will
> be a great choice in the future, scrypt has a much better ecosystem of