---
_id: '1365'
abstract:
- lang: eng
text: A memory-hard function (MHF) f is equipped with a space cost σ and time cost
τ parameter such that repeatedly computing fσ,τ on an application specific integrated
circuit (ASIC) is not economically advantageous relative to a general purpose
computer. Technically we would like that any (generalized) circuit for evaluating
an iMHF fσ,τ has area × time (AT) complexity at Θ(σ2 ∗ τ). A data-independent
MHF (iMHF) has the added property that it can be computed with almost optimal
memory and time complexity by an algorithm which accesses memory in a pattern
independent of the input value. Such functions can be specified by fixing a directed
acyclic graph (DAG) G on n = Θ(σ ∗ τ) nodes representing its computation graph.
In this work we develop new tools for analyzing iMHFs. First we define and motivate
a new complexity measure capturing the amount of energy (i.e. electricity) required
to compute a function. We argue that, in practice, this measure is at least as
important as the more traditional AT-complexity. Next we describe an algorithm
A for repeatedly evaluating an iMHF based on an arbitrary DAG G. We upperbound
both its energy and AT complexities per instance evaluated in terms of a certain
combinatorial property of G. Next we instantiate our attack for several general
classes of DAGs which include those underlying many of the most important iMHF
candidates in the literature. In particular, we obtain the following results which
hold for all choices of parameters σ and τ (and thread-count) such that n = σ
∗ τ. -The Catena-Dragonfly function of [FLW13] has AT and energy complexities
O(n1.67). -The Catena-Butterfly function of [FLW13] has complexities is O(n1.67).
-The Double-Buffer and the Linear functions of [CGBS16] both have complexities
in O(n1.67). -The Argon2i function of [BDK15] (winner of the Password Hashing
Competition [PHC]) has complexities O(n7/4 log(n)). -The Single-Buffer function
of [CGBS16] has complexities O(n7/4 log(n)). -Any iMHF can be computed by an algorithm
with complexities O(n2/ log1 −ε(n)) for all ε > 0. In particular when τ = 1
this shows that the goal of constructing an iMHF with AT-complexity Θ(σ2 ∗ τ )
is unachievable. Along the way we prove a lemma upper-bounding the depth-robustness
of any DAG which may prove to be of independent interest.
alternative_title:
- LNCS
author:
- first_name: Joel F
full_name: Alwen, Joel F
id: 2A8DFA8C-F248-11E8-B48F-1D18A9856A87
last_name: Alwen
- first_name: Jeremiah
full_name: Blocki, Jeremiah
last_name: Blocki
citation:
ama: 'Alwen JF, Blocki J. Efficiently computing data-independent memory-hard functions.
In: Vol 9815. Springer; 2016:241-271. doi:10.1007/978-3-662-53008-5_9'
apa: 'Alwen, J. F., & Blocki, J. (2016). Efficiently computing data-independent
memory-hard functions (Vol. 9815, pp. 241–271). Presented at the CRYPTO: International
Cryptology Conference, Santa Barbara, CA, USA: Springer. https://doi.org/10.1007/978-3-662-53008-5_9'
chicago: Alwen, Joel F, and Jeremiah Blocki. “Efficiently Computing Data-Independent
Memory-Hard Functions,” 9815:241–71. Springer, 2016. https://doi.org/10.1007/978-3-662-53008-5_9.
ieee: 'J. F. Alwen and J. Blocki, “Efficiently computing data-independent memory-hard
functions,” presented at the CRYPTO: International Cryptology Conference, Santa
Barbara, CA, USA, 2016, vol. 9815, pp. 241–271.'
ista: 'Alwen JF, Blocki J. 2016. Efficiently computing data-independent memory-hard
functions. CRYPTO: International Cryptology Conference, LNCS, vol. 9815, 241–271.'
mla: Alwen, Joel F., and Jeremiah Blocki. *Efficiently Computing Data-Independent
Memory-Hard Functions*. Vol. 9815, Springer, 2016, pp. 241–71, doi:10.1007/978-3-662-53008-5_9.
short: J.F. Alwen, J. Blocki, in:, Springer, 2016, pp. 241–271.
conference:
end_date: 2016-08-18
location: Santa Barbara, CA, USA
name: 'CRYPTO: International Cryptology Conference'
start_date: 2016-08-14
date_created: 2018-12-11T11:51:36Z
date_published: 2016-08-01T00:00:00Z
date_updated: 2021-01-12T06:50:11Z
day: '01'
department:
- _id: KrPi
doi: 10.1007/978-3-662-53008-5_9
intvolume: ' 9815'
language:
- iso: eng
main_file_link:
- open_access: '1'
url: http://eprint.iacr.org/2016/115
month: '08'
oa: 1
oa_version: Preprint
page: 241 - 271
publication_status: published
publisher: Springer
publist_id: '5876'
quality_controlled: '1'
scopus_import: 1
status: public
title: Efficiently computing data-independent memory-hard functions
type: conference
user_id: 3E5EF7F0-F248-11E8-B48F-1D18A9856A87
volume: 9815
year: '2016'
...