---
res:
  bibo_abstract:
  - The algorithm Argon2i-B of Biryukov, Dinu and Khovratovich is currently being
    considered by the IRTF (Internet Research Task Force) as a new de-facto standard
    for password hashing. An older version (Argon2i-A) of the same algorithm was chosen
    as the winner of the recent Password Hashing Competition. An important competitor
    to Argon2i-B is the recently introduced Balloon Hashing (BH) algorithm of Corrigan-Gibs,
    Boneh and Schechter. A key security desiderata for any such algorithm is that
    evaluating it (even using a custom device) requires a large amount of memory amortized
    across multiple instances. Alwen and Blocki (CRYPTO 2016) introduced a class of
    theoretical attacks against Argon2i-A and BH. While these attacks yield large
    asymptotic reductions in the amount of memory, it was not, a priori, clear if
    (1) they can be extended to the newer Argon2i-B, (2) the attacks are effective
    on any algorithm for practical parameter ranges (e.g., 1GB of memory) and (3)
    if they can be effectively instantiated against any algorithm under realistic
    hardware constrains. In this work we answer all three of these questions in the
    affirmative for all three algorithms. This is also the first work to analyze the
    security of Argon2i-B. In more detail, we extend the theoretical attacks of Alwen
    and Blocki (CRYPTO 2016) to the recent Argon2i-B proposal demonstrating severe
    asymptotic deficiencies in its security. Next we introduce several novel heuristics
    for improving the attack's concrete memory efficiency even when on-chip memory
    bandwidth is bounded. We then simulate our attacks on randomly sampled Argon2i-A,
    Argon2i-B and BH instances and measure the resulting memory consumption for various
    practical parameter ranges and for a variety of upperbounds on the amount of parallelism
    available to the attacker. Finally we describe, implement, and test a new heuristic
    for applying the Alwen-Blocki attack to functions employing a technique developed
    by Corrigan-Gibs et al. for improving concrete security of memory-hard functions.
    We analyze the collected data and show the effects various parameters have on
    the memory consumption of the attack. In particular, we can draw several interesting
    conclusions about the level of security provided by these functions. · For the
    Alwen-Blocki attack to fail against practical memory parameters, Argon2i-B must
    be instantiated with more than 10 passes on memory - beyond the "paranoid" parameter
    setting in the current IRTF proposal. · The technique of Corrigan-Gibs for improving
    security can also be overcome by the Alwen-Blocki attack under realistic hardware
    constraints. · On a positive note, both the asymptotic and concrete security of
    Argon2i-B seem to improve on that of Argon2i-A.@eng
  bibo_authorlist:
  - foaf_Person:
      foaf_givenName: Joel F
      foaf_name: Alwen, Joel F
      foaf_surname: Alwen
      foaf_workInfoHomepage: http://www.librecat.org/personId=2A8DFA8C-F248-11E8-B48F-1D18A9856A87
  - foaf_Person:
      foaf_givenName: Jeremiah
      foaf_name: Blocki, Jeremiah
      foaf_surname: Blocki
  bibo_doi: 10.1109/EuroSP.2017.47
  dct_date: 2017^xs_gYear
  dct_identifier:
  - UT:000424197300011
  dct_isPartOf:
  - http://id.crossref.org/issn/978-150905761-0
  dct_language: eng
  dct_publisher: IEEE@
  dct_title: Towards practical attacks on Argon2i and balloon hashing@
...