Efficiently Computing Data-Independent Memory-Hard Functions
Efficiently Computing Data-Independent Memory-Hard Functions
复制标题
高效计算数据独立的内存硬函数
DOI：
--
复制
发表时间：
2016
期刊：
影响因子：
--
通讯作者：
Jeremiah Blocki
中科院分区：
文献类型：
--
作者：
J. Alwen;Jeremiah Blocki
存储器函数MHF f与空间成本相等，$$ {\ sigma} $$和时间成本$$ {\ tau} $$参数，因此反复计算$$ f _ {{\ sigma}，{\ tau}，{\ tau} } $$在特定的集成电路上，相对于一台通用计算机，我们希望任何通用电路都在经济上有利。 $$ $$ $$的$$ \ times $$时间\ v vartheta {\ sigma} ^2 * {\ tau} $$可以使用几乎最佳的内存和时间来计算它的附加属性。复杂性通过独立于输入值的模式访问内存的算法，可以通过在$$ n = \ vartheta {\ sigma} * {\ tau} $$上定义有向的acyclic Graph dag g来指定此类功能。计算图。
在这项工作中，我们开发了用于分析IMHF的新工具。接下来，我们描述了一种算法$$ {{\ Mathcal {a}}}} $$，用于基于任意dag g的IMHF，我们以每一个实例评估的范围G.的某些组合特性。
接下来，我们实例化了几个一般的DAG攻击，其中包括文献中许多最重要的IMHF候选者的攻击。 $$ {\ tau} $$和螺纹计数，以便$$ n = {\ sigma} *{\ tau} $$。
catena-dragonfly函数i¾？[flw13]在^{{1.67} $$上具有和能量复杂性$$。 - buffer和i¾的线性函数？[cgbs16]两者在^{1.67} $$上都具有复杂性。 7/4} \ log n $$。i¾的单屏流函数函数？[cgbs16]具有复杂性$$ on^{7/4} \ log n $$。任何IMHF可以通过具有复杂性$$的算法计算的任何IMHF ^2/\ log ^{1- {\ epsilon}} n $$用于所有$$ {\ epsilon}> 0 $$。带有at-complexity $$ \ vartheta {\ sigma} ^2 * {\ tau} $$的IMHF是无法实现的。
一路走来，我们证明了引理的上限，任何DAG的深度固定性可能被证明具有独立感兴趣。
A memory-hard function MHF f is equipped with a space cost $${\sigma } $$ and time cost $${\tau } $$ parameter such that repeatedly computing $$f_{{\sigma },{\tau }}$$ on an application specific integrated circuit ASIC is not economically advantageous relative to a general purpose computer. Technically we would like that any generalized circuit for evaluating an iMHF $$f_{{\sigma },{\tau }}$$ has area $$\times $$ time AT complexity at $$\varTheta {\sigma } ^2 * {\tau }$$ . A data-independent MHF iMHF has the added property that it can be computed with almost optimal memory and time complexity by an algorithm which accesses memory in a pattern independent of the input value. Such functions can be specified by fixing a directed acyclic graph DAG G on $$n=\varTheta {\sigma } * {\tau }$$ nodes representing its computation graph.
In this work we develop new tools for analyzing iMHFs. First we define and motivate a new complexity measure capturing the amount of energy i.e. electricity required to compute a function. We argue that, in practice, this measure is at least as important as the more traditional AT-complexity. Next we describe an algorithm $${{\mathcal {A}}} $$ for repeatedly evaluating an iMHF based on an arbitrary DAG G. We upperbound both its energy and AT complexities per instance evaluated in terms of a certain combinatorial property of G.
Next we instantiate our attack for several general classes of DAGs which include those underlying many of the most important iMHF candidates in the literature. In particular, we obtain the following results which hold for all choices of parameters $${\sigma } $$ and $${\tau } $$ and thread-count such that $$n={\sigma } *{\tau } $$ .
The Catena-Dragonfly function ofi¾?[FLW13] has AT and energy complexities $$On^{1.67}$$ .The Catena-Butterfly function ofi¾?[FLW13] has complexities is $$On^{1.67}$$ .The Double-Buffer and the Linear functions ofi¾?[CGBS16] both have complexities in $$On^{1.67}$$ .The Argon2i function ofi¾?[BDK15] winner of the Password Hashing Competitioni¾?[PHC] has complexities $$On^{7/4}\log n$$ .The Single-Buffer function ofi¾?[CGBS16] has complexities $$On^{7/4}\log n$$ .Any iMHF can be computed by an algorithm with complexities $$On^2/\log ^{1-{\epsilon }}n$$ for all $${\epsilon } > 0$$ . In particular when $${\tau } =1$$ this shows that the goal of constructing an iMHF with AT-complexity $$\varTheta {\sigma } ^2 * {\tau }$$ is unachievable.
Along the way we prove a lemma upper-bounding the depth-robustness of any DAG which may prove to be of independent interest.