4 ms·
I did not read it, but I can't imagine what would prevent an attacker from running a parallel attack on multiple circuits/computers that aren't sharing any reso
by amix 17y ago
I did not read it, but I can't imagine what would prevent an attacker from running a parallel attack on multiple circuits/computers that aren't sharing any resources...
- dfranke 17y agoThe idea is to make the KDF expensive in space as well as time. While bcrypt costs a few seconds of CPU time, it uses only a tiny amount of RAM, thus underutilizing the resources you have available. Thus, you can parallelize an attack using lots of specialized ASICs but only a commodity amount of storage. Scrypt would require you to purchase lots of RAM for every ASIC, making a brute force attack much more costly.
- cperciva 17y agoThus, you can parallelize an attack using lots of specialized ASICs... More to the point, you can parallelize attacks on most KDFs by building an ASIC with many copies of a password-cracking circuit. With scrypt, the vast majority of the IC area (and thus cost) is RAM.