LUlucb1e·Aug 8, 2023
I agree, but you literally have no other option: https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypt...
Web cryptography is stuck in the 1990s. PBKDF2 is the only available algorithm, which gives an attacker's GPUs a big advantage over honest users, let alone ASICs.
Maybe a webassembly-based solution, implementing something like Bcrypt or Scrypt/Argon2, is comparable to a browser-native implementation, but that would have to be verified before taking my word for it. These algorithms provide varying amounts of memory-hardness (Bcrypt only 4KB but even that proved surprisingly effective), which causes contention on the GPU memory bus (they're only a bit faster than the CPU's memory bus, making the GPU have only a small advantage, on the order of 5x instead of 100x) and causes larger ASIC die sizes (which the Argon2 paper argues is
Read the rest
what causes cost for the attacker).
Source for the latter: https://github.com/P-H-C/phc-winner-argon2/blob/16d3df698db2... section 2.1
> We aim to maximize the cost of password cracking on ASICs. There can be different approaches to measure this cost, but we turn to one of the most popular – the time-area product [4, 16]. [...]
> - The 50-nm DRAM implementation [10] takes 550 mm² per GByte;
> - The Blake2b implementation in the 65-nm process should take about 0.1 mm² (using Blake-512 implementation in [11]);
I understand from this that adding more memory on the ASIC/chip is more expensive than adding more computing power.