High Parallel Complexity Graphs and Memory-Hard Functions

Abstract

Abstract. We develop new theoretical tools for proving lower-bounds on the (amortized) complexity of functions in a parallel setting. We demonstrate their use by constructing the first provably secure Memory-hard functions (MHF); a class of functions recently gaining acceptance in practice as an effective means to counter brute-force attacks on security relevant functions.Pebbling games over graphs have proven to be a powerful abstraction for a wide variety of computational models. A dominant application of such games is proving complexity lower-bounds using "pebbling reductions". These bound the complexity of a given function fG in some computational model M of interest in terms of the pebbling complexity of a related graph G, where the pebbling complexity is defined via a pebbling game G. In particular, finding a function with high complexity in M is reduced to (the hopefully simpler task of) finding graphs with high pebbling complexity in G. We introduce a very simple and natural pebbling game Gp for abstracting parallel computation models. As an important conceptual contribution we also define a natural measure of pebbling complexity called cumulative complexity (CC) and show how it overcomes a crucial shortcoming in the parallel setting exhibited by more traditional complexity measures used in past reductions. Next (analogous to the results of Tarjan et. al. [PTC76,LT82] for sequential pebbling games) we demonstrates, via a novel and non-tibial proof, an explicit construction of a constant in-degree family of graphs whose CC in Gp approaches maximality to within a polylogarithmic factor for any graph of equal size.To demonstrate the use of these theoretical tools we give an example in the field of cryptography, by constructing the first provably secure Memory-hard function (MHF). Introduced by Percival [Per09], an MHF can be computed efficiently on a sequential machine but further requires the same amount of memory (or much greater time) amortized per evaluation on a parallel machine. Thus, while a say an ASIC or FPGA may be faster than a CPU, the increased cost of working memory negates this advantage. In particular MHFs crucially underly the ASIC/FPGAresistant proofs-of-work of the crypto-currency Litecoin[Cha11], the brute-force resistant key-derivation function scrypt [Per09] and can be used to increase the cost to an adversary of recovering passwords from a compromised login server. To place these applications on more sound theoretic footing we first provide a new formal definition (in the Random Oracle Model) and an accompanying notion of amortized memory hardness to capture the intuitive property of an MHF (thereby remedying an important issue with the original definition of [Per09]). Next we define a mapping from a graph G to a related function fG. Finally we prove a pebbling reduction bounding the amortized memory hardness per evaluation of fG in terms of the CC of G in the game Gp. Together with the construction above, this gives rise to the first provably secure example of an MHF.

Hardness of Approximation in PSPACE and Separation Results for Pebble Games

“…Without this constraint it would be much easier, but also much less interesting, to prove our results. 1 Another aspect worth pointing out is that although the reversible pebble game is weaker than the standard pebble game, it is technically much more challenging to analyze. The reason for this is that a standard pebbling will always progress in a "forward sweep" through the graph in topological order, and so one can often assume without loss of generality that once one has pebbled through some subgraph the pebbling will never touch this subgraph again.…”

Tradeoff Cryptanalysis of Memory-Hard Functions

“…Depending on the architecture, the costs vary significantly for the same algorithm A. For the ASIC-equipped attackers, who can use parallel computing cores, it is widely suggested that the costs can be approximated by the time-area product AT [9,11,28,35]. Here T is the time complexity of the used algorithm and A is the sum of areas needed to implement the memory cells and the area needed to implement the cores.…”

“…A simple tradeoff for scrypt has been known in folklore and was recently formalized in [20]. Alwen and Serbinenko analyzed a simplified version of Catena in [9]. Designers of Lyra2 and Catena attempted to attack their own designs in the original submissions [20,25].…”

Proofs of Space

“…If we model the hash function H as a random oracle [12], then the sender must compute an expected 2 t hashes until she finds such a σ. 4 A useful property of this PoW is that there is no speedup when one has to find many proofs, i.e., finding s proofs requires s2 t evaluations. The value t should be chosen such that it is not much of a burden for a party sending out a few emails per day (say, it takes 10 seconds to compute), but is expensive for a Spammer trying to send millions of messages.…”

“…In [1] Abadi, Burrows, Manasse and Wobber observed that CPU speeds may differ significantly between different devices and proposed as an alternative measure the number of times the memory is accessed (i.e., the number of cache misses) in order to compute the proof. This approach was formalized and further improved in [19,55,21,4], which use pebbling based techniques. Such memory-hard functions cannot be used as PoS as the memory required to compute and verify the function is the same for provers and verifiers.…”