Bandwidth Hard Functions for ASIC Resistance
Bandwidth Hard Functions for ASIC Resistance
复制标题
抗 ASIC 的带宽硬函数
DOI：
--
复制
发表时间：
2017
期刊：
影响因子：
--
通讯作者：
S. Devadas
中科院分区：
文献类型：
--
作者：
Ling Ren;S. Devadas
加密哈希函数有着广泛的应用，包括密码哈希，垃圾邮件和拒绝服务对策的定价函数以及加密货币中的工作证明。ASIC（专用集成电路）哈希引擎的最新进展引起了对上述应用的安全性的关注。这导致了对ASIC抵抗散列函数和ASIC抵抗工作量证明方案的兴趣日益增长，即，这些都没有给ASIC带来巨大的优势。今天，实现ASIC抵抗性的标准方法是通过内存硬功能或内存硬工作量证明方案。然而，我们观察到记忆硬度方法是一个不完整的解决方案。它只是试图提供阻力ASIC的面积优势，但忽略了更重要的能源优势。在本文中，我们提出了带宽硬函数的概念，以减少ASIC的能源优势。CPU无法与ASIC竞争计算的能源效率，但我们可以依靠内存访问来减少ASIC的能源优势，因为内存访问的能源成本对于ASIC和CPU来说是相当的。我们提出了一个模型的硬件能源成本，在实践中有良好的基础。然后，我们分析了ASIC抵抗候选者的带宽硬度特性。我们发现scrypt，Catena-BRG和Balloon在适当的参数下是带宽硬的。最后，我们观察到容量硬函数不一定是带宽硬的，堆叠的双蝴蝶图是一个反例。
Cryptographic hash functions have wide applications including password hashing, pricing functions for spam and denial-of-service countermeasures and proof of work in cryptocurrencies. Recent progress on ASIC (Application Specific Integrated Circuit) hash engines raise concerns about the security of the above applications. This leads to a growing interest in ASIC resistant hash function and ASIC resistant proof of work schemes, i.e., those that do not give ASICs a huge advantage. The standard approach towards ASIC resistance today is through memory hard functions or memory hard proof of work schemes. However, we observe that the memory hardness approach is an incomplete solution. It only attempts to provide resistance to an ASIC’s area advantage but overlooks the more important energy advantage. In this paper, we propose the notion of bandwidth hard functions to reduce an ASIC’s energy advantage. CPUs cannot compete with ASICs for energy efficiency in computation, but we can rely on memory accesses to reduce an ASIC’s energy advantage because energy costs of memory accesses are comparable for ASICs and CPUs. We propose a model for hardware energy cost that has sound foundations in practice. We then analyze the bandwidth hardness property of ASIC resistant candidates. We find scrypt, Catena-BRG and Balloon are bandwidth hard with suitable parameters. Lastly, we observe that a capacity hard function is not necessarily bandwidth hard, with a stacked double butterfly graph being a counterexample.