Movatterモバイル変換

Balloon hashing

From Wikipedia, the free encyclopedia

Memory-hard key derivation function

Balloon hashing is akey derivation function presenting proven memory-hard password-hashing and modern design. It was created byDan Boneh, Henry Corrigan-Gibbs (both atStanford University) and Stuart Schechter (Microsoft Research) in 2016.^[1]^[2]

The authors claim that Balloon:

hasprovenmemory-hardness properties,
is built from standard primitives: it can use any standard non-space-hardcryptographic hash function as a sub-algorithm (e.g.,SHA-3,SHA-512),
is resistant toside-channel attacks: the memory access pattern is independent of the data to be hashed,
is easy to implement and matches the performance of similar algorithms.

Balloon is compared by its authors withArgon2, a similarly performing algorithm.^[1]

There are three steps in the algorithm:^[1]

Expansion, where an initial buffer is filled with apseudorandom byte sequence derived from the password and salt repeatedly hashed.
Mixing, where the bytes in the buffer are mixedtime_cost number of times.
Output, where a portion of the buffer is taken as the hashing result.

^^a ^b ^cBoneh, Dan; Corrigan-Gibbs, Henry; Schechter, Stuart (2016-01-11)."Balloon Hashing: A Memory-Hard Function Providing Provable Protection Against Sequential Attacks".Cryptology ePrint Archive.2016 (27). Retrieved2019-09-03.
^"Balloon Hashing".Stanford Applied Crypto Group. Stanford University. Retrieved2019-09-03.

v t e Cryptographic hash functions andmessage authentication codes
List Comparison Known attacks
Common functions	MD5 (compromised) SHA-1 (compromised) SHA-2 SHA-3 BLAKE2
SHA-3 finalists	BLAKE Grøstl JH Skein Keccak (winner)
Other functions	BLAKE3 CubeHash ECOH FSB Fugue GOST HAS-160 HAVAL Kupyna LSH Lane MASH-1 MASH-2 MD2 MD4 MD6 MDC-2 N-hash RIPEMD RadioGatún SIMD SM3 SWIFFT Shabal Snefru Streebog Tiger VSH Whirlpool
Password hashing/ key stretching functions	Argon2 Balloon bcrypt Catena crypt LM hash Lyra2 Makwa PBKDF2 scrypt yescrypt
General purpose key derivation functions	HKDF KDF1/KDF2
MAC functions	CBC-MAC DAA GMAC HMAC NMAC OMAC/CMAC PMAC Poly1305 SipHash UMAC VMAC
Authenticated encryption modes	CCM ChaCha20-Poly1305 CWC EAX GCM IAPM OCB
Attacks	Collision attack Preimage attack Birthday attack Brute-force attack Rainbow table Side-channel attack Length extension attack
Design	Avalanche effect Hash collision Merkle–Damgård construction Sponge function HAIFA construction
Standardization	CAESAR Competition CRYPTREC NESSIE NIST hash function competition Password Hashing Competition NSA Suite B CNSA
Utilization	Hash-based cryptography Merkle tree Message authentication Proof of work Salt Pepper

v t e Cryptography
General	History of cryptography Outline of cryptography Classical cipher Cryptographic protocol Authentication protocol Cryptographic primitive Cryptanalysis Cryptocurrency Cryptosystem Cryptographic nonce Cryptovirology Hash function Cryptographic hash function Key derivation function Secure Hash Algorithms Digital signature Kleptography Key (cryptography) Key exchange Key generator Key schedule Key stretching Keygen Machines Ransomware Random number generation Cryptographically secure pseudorandom number generator (CSPRNG) Pseudorandom noise (PRN) Secure channel Insecure channel Subliminal channel Encryption Decryption End-to-end encryption Harvest now, decrypt later Information-theoretic security Plaintext Codetext Ciphertext Shared secret Trapdoor function Trusted timestamping Key-based routing Onion routing Garlic routing Kademlia Mix network
Mathematics	Cryptographic hash function Block cipher Stream cipher Symmetric-key algorithm Authenticated encryption Public-key cryptography Quantum key distribution Quantum cryptography Post-quantum cryptography Message authentication code Random numbers Steganography
Category

Hidden categories: