On 11/17/12 02:53, Solar Designer wrote: > On Sat, Nov 17, 2012 at 05:20:54AM +0400, Solar Designer wrote: >> Thus, we have halved our memory needs (circuit area) and paid for this >> by only a 25% increase in processing time. >> >> Now, if we want to reduce our memory needs a lot more, the situation is >> a lot better (for the defender). > > Actually, unless I am mistaken, the area-time product is asymptotically > (by making extreme use of this trade-off) only 25% of what's expected in > the scrypt paper.
You get a 2x cost reduction by trading increased time for reduced area (as in a previous email) and another 2x reduction by ignoring the initial setup (practically speaking) but I never intended to include the setup in my area-time bound. -- Colin Percival Security Officer Emeritus, FreeBSD | The power to serve Founder, Tarsnap | www.tarsnap.com | Online backups for the truly paranoid
