Paper 2022/832
Sustained Space and Cumulative Complexity Tradeoffs for DataDependent MemoryHard Functions
Abstract
Memoryhard functions (MHFs) are a useful cryptographic primitive which can be used to design egalitarian proof of work puzzles and to protect low entropy secrets like passwords against bruteforce attackers. Intuitively, a memoryhard function is a function whose evaluation costs are dominated by memory costs even if the attacker uses specialized hardware (FPGAs/ASICs), and several cost metrics have been proposed to quantify this intuition. For example, spacetime cost looks at the product of running time and the maximum space usage over the entire execution of an algorithm. Alwen and Serbinenko (STOC 2015) observed that the spacetime cost of evaluating a function multiple times may not scale linearly in the number of instances being evaluated and introduced the stricter requirement that a memoryhard function has high cumulative memory complexity (CMC) to ensure that an attacker's amortized spacetime costs remain large even if the attacker evaluates the function on multiple different inputs in parallel. Alwen et al. (EUROCRYPT 2018) observed that the notion of CMC still gives the attacker undesirable flexibility in selecting spacetime tradeoffs e.g., while the MHF scrypt has maximal CMC $\Omega(N^2)$, an attacker could evaluate the function with constant $O(1)$ memory in time $O(N^2)$. Alwen et al. introduced an even stricter notion of Sustained Space complexity and designed an MHF which has $s=\Omega(N/\log N)$ sustained complexity $t=\Omega(N)$ i.e., any algorithm evaluating the function in the parallel random oracle model must have at least $t=\Omega(N)$ steps where the memory usage is at least $\Omega(N/\log N)$. In this work, we use dynamic pebbling games and dynamic graphs to explore tradeoffs between sustained space complexity and cumulative memory complexity for datadependent memoryhard functions such as Argon2id and scrypt. We design our own dynamic graph (dMHF) with the property that {\em any} dynamic pebbling strategy either (1) has $\Omega(N)$ rounds with $\Omega(N)$ space, or (2) has CMC $\Omega(N^{3\epsilon})$  substantially larger than $N^2$. For Argon2id we show that {\em any} dynamic pebbling strategy either(1) has $\Omega(N)$ rounds with $\Omega(N^{1\epsilon})$ space, or (2) has CMC $\omega(N^2)$. We also present a dynamic version of DRSample (Alwen et al. 2017) for which {\em any} dynamic pebbling strategy either (1) has $\Omega(N)$ rounds with $\Omega(N/\log N)$ space, or (2) has CMC $\Omega(N^3/\log N)$.
Note: Full version
Metadata
 Available format(s)
 Category
 Foundations
 Publication info
 Published by the IACR in CRYPTO 2022
 Keywords
 DataDependent Memory Hard Function Dynamic Pebbling Game Sustained Space Complexity Cumulative Memory Complexity
 Contact author(s)

jblocki @ purdue edu
holman14 @ purdue edu  History
 20220627: approved
 20220623: received
 See all versions
 Short URL
 https://ia.cr/2022/832
 License

CC BY
BibTeX
@misc{cryptoeprint:2022/832, author = {Jeremiah Blocki and Blake Holman}, title = {Sustained Space and Cumulative Complexity Tradeoffs for DataDependent MemoryHard Functions}, howpublished = {Cryptology ePrint Archive, Paper 2022/832}, year = {2022}, note = {\url{https://eprint.iacr.org/2022/832}}, url = {https://eprint.iacr.org/2022/832} }