[Cryptech Tech] Incremental digest outputs

[Joachim Strömbergson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Aloha!

Bernd Paysan wrote:
> For passwords of on-HSM crytpo storage, you want to have a "loop
> permutation rounds for a second as fast as you can" or so, to make
> brute-force attacks expensive.  That's the place where having a fast
> hash on the HSM is most important, because the faster the hash on the
> HSM for password diffusion is, the harder it becomes for a
> brute-force attacker without making the HSM feel slow.
> 
> So you might want to have a counter-based "run the hash state
> transition as fast as possible without new input for n cycles" to
> support this mode.

Very good suggestion, thanks!

And adding the functionality is trivial. Basically a 32-bit counter with
a sensible default that can be set by the system to as many iterations
as needed/wanted. (32-bit is probably overkill too, but the HW cost is
very low.)

And then have a strengthening mode bit settable in the control register
to enable/disable the functionality.

- -- 
Med vänlig hälsning, Yours

Joachim Strömbergson - Alltid i harmonisk svängning.
========================================================================
 Joachim Strömbergson          Secworks AB          joachim at secworks.se
========================================================================
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBCAAGBQJUaOxTAAoJEF3cfFQkIuyNUA0QAI87mG6I7oKSJLBWkQ1SibHv
qL9R6Z4Iob1UXHXPIK20gnPLMXniFeEkz3hcQ0wzRXWnEi8ms+w/EA8US4Y6Wogb
XgswjAh6UmYvjfXt83/8P1QMl8YoyKlZmAJy1Nu36qO2QsQmy1/JGDj0FwK+YFRJ
hLxzwe5S/F1MTuH3+IL3Ql4enamuB1noSNRsFl5PfuLg4eCo4XHZqhFxYrAEQOQw
BSFjXcS7wbyFps540M2AGClaWdEufErt9vLpE2D5XXxEClaTW98Febf07xN2PlBj
qHECUPGVHYaAHzC6FOJaGL0ymE402tKV1AbPLI1T5r4wazaWjA1iChBfOkYJSFSM
Skfuh18PwKROAkTlrPxUsvV0dC+5Rp9PZzQj2cLBIDcedcoZeEQTHaKnDsIsms46
EJBmbkMgNY3kszZDkE2hdkLix0/ReFZDxPwdL89epd2kvkeMCRZSXfuBBXceVo4j
6Fc9z2LQimiD4JVblDERUd1NRdcsMSX7eJMDj+Rd9sbx+CsKuu/kYqV2536ILfx0
bhZjj+nDNW52fb2ElFI7nNRd/Tqg7DnGo9Vq52C0nf/r/HVDS5v0f5tFMfefalNl
In/6E9WJnt+tR4Vm8OZDjd50iH/ZofaU9GEvpPvaDmnLwXFYEclKt/r2xeu7+Ua3
sMAJF3PpzgeM91cK/WbF
=vEs4
-----END PGP SIGNATURE-----