Subject: Re: [Cfrg] adopting Argon2 as a CFRG document

From: Jeremiah Blocki <[email-masked]>
Date: Tue, 31 May 2016 13:36:53 +0000

Hi Jean,

I wanted to add a quick clarifying statement about the `contradictory' claims.

A few months ago we updated [AB16] on ePrint to add Section 5.1. Briefly, in Section 5.1 we make the observation that there is a simple way to optimize our attacks against multi-pass variants of Argon2i. The optimization (roughly) reduces costs by a factor of tau (the number of passes through memory).

I believe that Section 5.6 of the Argon2i paper was written before we updated [AB16] to add Section 5.1 (optimized attack against multi-pass variants of Argon2i).

I also want to reiterate a point that Joel made: The analysis from [AB16] only upper-bounds the (energy/amortized-AT) complexity of the attack. It is possible (likely) that the upper-bound overestimates complexity by a constant factor (if true then the attack from [AB16] is even stronger).

Jeremiah