6

The password hashing competition, started in 2014 and Argon2 was the winner in 2015, listed evaluation criteria for the competition. There is an interesting one in the Functionality section;

Ability to transform an existing hash to a different cost setting without knowledge of the password.

This is a quite good functionality if the security administrators just want to increase the iteration, instead of waiting for the user to enter the system with their password, they can process the hashed passwords in a seamless manner.

Apart from simple iterated hashing, I'm not aware of any good password hashing algorithm that supports this functionality. This can be seen below.

let H(s)(password) = H(H(...(H(password))...)), i.e. hashing s-times.

Then hashing s+t-times is just H(s+t)(password) =H(t)(H(s)(password))

Questions:

  1. Are there any good password hashing algorithms that support this?
  2. Is there a good reason not to support this?

For 2, I can only consider that the memory hardness cannot be truly satisfied since the process must stop and start with new memory information therefore the attacker can amortize the memory usage. Even, the CPU/GPUs can be amortized, too.

5
  • 1
    Your 1st question duplicates this one.
    – mentallurg
    Jan 9, 2022 at 22:11
  • @mentallurg nice find. Well, as I guessed that is only possible if the input size is equal to output size as in Argon2 ( see on figure 2 the stadium shaped orange boxes), actually did this without mentioned on their paper's features section. I've found the paper weak in this manner since if you trim or want larger than the default output there is a problem. 1/2
    – kelalaka
    Jan 10, 2022 at 8:26
  • Also, The memory pool changes, so Argon2(Argon2(pwd, iteration = 1,...), iteration =1,...) is not equal to Argon2(pwd, iteration=2). Therefore the paper is really bad and the Argon2's team was right about not mentioning it as a feature. 2/2
    – kelalaka
    Jan 10, 2022 at 8:28
  • It is not only about Argon. Many others like Yescrypt seem to support it, too. But I have not tested them.
    – mentallurg
    Jan 10, 2022 at 9:25
  • @mentallurg I know there are many listed there, however, I expect the same result due to memory pool issue as in the Argon2. In short, the functionality is not satisfied.
    – kelalaka
    Jan 10, 2022 at 9:31

1 Answer 1

1

Any hashing function can be made to take twice as long, by calculating H(H(pass)) instead of H(pass), and this is often what happens in practice when algorithms claim client-independant update, for example in yescrypt.

This enables a precomputation attack. An attacker can create a table for H(i), where i is all possible output values of H(pass). This table would help him to calculate H(H(pass)) faster. The only way to prevent precomputation is to use the password in each hash iteration.

So there is a security advantage in needing the password for each hashing iteration, but this also means that it is not possible to upgrade to more iterations without having the password.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .