1
$\begingroup$

Why was my question “Very simple, very memory-hard (?) password-based key derivation” locked as off-topic ? Before posting it, i read the entire help page and i knew i was pushing it but i still thought it was strictly within the limits of what's considered on-topic.

Note: i don't even want my question re-opened (i already got the answer i came here for...), i just want to know why it was considered off-topic so i can avoid making the same mistake again.

$\endgroup$
4
$\begingroup$

While your question was offtopic, but also low quality which got you downvoted. I would mostly question few things:

  • It is offtopic because it asks for analyzing of whole cryptosystem, not a specific construct
  • It appears that you just threw some hashes here and there. I understand that wasn't your intention, but thats what cryptographers who don't understand cryptography do. This includes mixing more hash functions, reversing string, add some value to every byte or so... We don't like that, as cryptography is not obscurity. You should have used some KDF there.

I think second point made people dislike your question, because it didn't provide any reasons for adding more hash functions, chaining hashes etc. Also, your question wasn't well written:

  • You copy-pasted your code, without changing every call to hash to something shorter which would ease reading.
  • You used constant number 3849... Of course it was chosen following week-long search :)

There are some more problems with your question:

upon running the "algorithm" with those exact parameters (it's C#) it peaked at about ~2 Megabytes (very rough estimate) of memory consumption.

same would happen with malloc(2*1024*1024). This doesn't show us you done any research. Not in cryptographic sense.

This type of constuction seems way too simple to be any good, but i couldn't break it myself

Again, cryptography isn't about being complex. We dislike unnecessary complex schemes, as they rely on obscurity, not computational complexity. This is exactly what your algorithm did, not other way around.

So, all in all, I would say mostly your question was closed because it was low-quality, it showed basic misunderstanding of cryptography. You indeed rolled your own (principle which you know about), and without doing research you thought "oh yes seems secure, let's just use it". On top of that it was offtopic, because we don't analyze complete cryptosystems - because everyone can design another cryptosystem without understanding why previous one was broken, we don't have time to analyze them all - especially as analyzing them takes longer than designing. Your question was also downvoted, because you didn't show you did any research on thing you produced. But we spent time reading it and we even broke it - it probably took longer than designing it. People got feeling you don't respect their time.

So next time try to show us that you took some time to research your question and design rational algorithm. Make it easy to read for us. Your code is probably readable as code, but not as cryptographic algorithm. And of course be sure your question is ontopic, as your question was indeed offtopic.

$\endgroup$
  • $\begingroup$ I could explain to you my reasoning for most of what's in the code (but i didn't think it would add anything to the question). For instance, the much-criticized GetSha384HashString(passwd) + GetSha384HashString(passwd + passwd) + GetSha384HashString(passwd + passwd + passwd); is just my way of getting more unrepeated bytes of output via what i thought/think was cheaper than doing another iteration of the nested SHA-384 above it. As for copy-pasting my code, i did edit it before posting, but i certainly could have made e.g: the calls to SHA-384 much shorter. $\endgroup$ – cipher Dec 5 '16 at 22:54
  • 2
    $\begingroup$ That much-criticized method is reinventing the wheel, we have KDFs for that. And it's usually cheaper than your "cheap" method. I know it's not easy to follow best standards, but replacing them with your own "replacements" is easy way to void any security. Perhaps you should try implementing scrypt/argon2 binary-compatible implementation. Then you will learn best practices and have working library. Of course, it will still have side-channels, but those are much harder... :) $\endgroup$ – axapaxa Dec 6 '16 at 0:03
4
$\begingroup$

@axapaxa provided a good answer explaining why it was off-topic, but I'll add me two cents and dive into the reasons why I "locked" the Q&A.

Actually, I would have put the question "on hold" as off-topic because (quote):

Requests for analyzing ciphertext or reviewing full cryptographic designs are off-topic, as the results are rarely useful to anyone else and/or would be too long for this site.

(emphasis mine)

Note that I actively interpreted the NET stuff as benign and assumed that to be your way of describing your home-made algo, and not to be part of a "is my NET code correct/secure/whatever" kind of question. Nevertheless, your question clearly stumbled over the off-topic reason provided above - which is why I locked it.

Actually, the lock mesage already indicates why locking was the more constructive thing to do (quote):

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed.

But I'll gladly explain why it was the more constructive choice and what the main, most important reasons were for me to "lock" it instead of putting it "on hold":

  1. Putting it "on hold" would stil allow people to downvote your question, which already showed -3 when I locked it. Locking a Q&A prevents further voting... and thereby saves you from losing even more reputation due to further "off topic" based downvotes.
  2. Putting it "on hold" would put the Q&A at risk of potential deletion. Locking it based on "historical significance" prevents deletion, or - at least - makes people think twice before killing the Q&A at a later time.
  3. Your question received two usefull answers, of which you already accepted one at the time of locking. Since that answer obviously answered your question to your satisfaction, locking it keeps the Q&A around for your personal, future reference. (remember #2)

All in all, the only really negative part of locking things in your specific case is that locking the Q&A keeps an off-topic Q&A around. That's why the bolded lock-message explains to other users that the question is not on-topic, so they can't argue "hey, someone asked an alike question so why can't I do the same"; which would only open the door to alike, off-topic questions.

Hope that helps you understand why - for you - my choice to lock this particular Q&A was the most constructive and gentle way to handle your off-topic question. In case of doubt or if something is unclear, please feel invited to drop a line via our chat. I'm always open to help by explaining whatever part(s) of my wording may be confusing.

Last but not least: since you state you explicitly wanted to avoid clashing into off-topicness and checked major parts of the help center, it might well be that our help center is missing some information somewhere. (Nothing is perfect.) If you think that's the case, you are definitely more than welcome to suggest/request additions and/or edits to our help center by simply posting an according meta Q.

$\endgroup$
  • $\begingroup$ The main thing which made me think it was on topic was this However, you might like to break your problem down into specifics, such as "under these conditions, does structure X have desired security property Y?" which would be a perfect fit for us. (from here) put together with second and third paragraph of this $\endgroup$ – cipher Dec 5 '16 at 23:03
  • 2
    $\begingroup$ @cipher What would have been an interesting fit (but is an unneccessary Q now) would be what codes' analyzed there: "Is repeated hashing with appending memory-hard?" to which the obvious answer would be (now): "No it isn't because you can just update the of the hash state there and get away with a tiny amount of memory". So rather than talking about super-concrete, complete schemes like that one, talk about the ideas that compose the scheme (and prefer a simple algorithmic notation wherever possible). $\endgroup$ – SEJPM Dec 5 '16 at 23:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .