# Lyra2

Lyra2 is a password hashing scheme (PHS) that can also function as a key derivation function (KDF). It gained recognition during the Password Hashing Competition in July 2015, which was won by Argon2. It is also used in proof-of-work algorithms such as Lyra2REv2, adopted by Vertcoin and MonaCoin, among other cryptocurrencies.
Lyra2 was designed by Marcos A. Simplicio Jr., Leonardo C. Almeida, Ewerton R. Andrade, Paulo C. F. dos Santos, and Paulo S. L. M. Barreto from Escola Politécnica da Universidade de São Paulo. It is based on Lyra, which had been created by the same team. Lyra2 includes:
* The ability to configure the desired amount of memory, processing time, and parallelism for the algorithm.
* High memory usage with processing time similar to scrypt.
In addition, it:
* Provides higher security against time-memory trade-offs.
* Allows legitimate users to better benefit from the parallelism capabilities of their own platforms.
* Increases the costs of creating dedicated hardware to attack the algorithm.
* Balances resistance against side-channel threats and attacks using cheaper, slower storage devices.
Lyra2 is released into the public domain.

## Design

As any PHS, Lyra2 takes as input a salt and a password, creating a pseudorandom output that can then be used as key material for cryptographic algorithms or as an authentication string.
Internally, the scheme's memory is organized as a matrix that is expected to remain in memory during the whole password hashing process. Since its cells are iteratively read and written, discarding a cell for saving memory leads to the need of recomputing it whenever it is accessed once again, until the point it was last modified.
The construction and visitation of the matrix is done using a stateful combination of the absorbing, squeezing and duplexing operations of the underlying sponge (i.e., its internal state is never reset to zero), ensuring the sequential nature of the whole process.
Also, the number of times the matrix's cells are revisited after initialization is defined by the user, allowing Lyra2's execution time to be fine-tuned according to the target platform's resources.

### Inputs

* password
* salt
* t_cost - execution time
* m_cost - memory required
* outlen
The algorithm additionally enables parameterization in terms of:
* degree of parallelism (number of threads $p$)
* underlying permutation function (can be seen as the main cryptographic primitive)
* number of blocks used by the underlying permutation function (bitrate)
* number of rounds performed for the underlying permutation function ($\rho$)
* number of bits to be used in rotations ($\omega$)
* output length($\kappa$)

### Functions/symbols

    Concatenate two strings
    Bitwise XOR
    Word wise add operation (i.e., ignoring carries between words)
    Modulus

#### W

    The target machine's word size (usually, 32 or 64)

#### omega

    Number of bits to be used in rotations (recommended: a multiple of the machine's word size, W)
    Right rotation

#### rho

    Number of rounds for reduced squeeze or duplexing operations

#### blen

    Sponge's block size in bytes

#### H or H_i

    Sponge with block size blen (in bytes) and underlying permutation f

#### H.absorb(input)

    Sponge's absorb operation on input

#### H.squeeze(len)

    Sponge's squeeze operation of len bytes

#### H.squeeze_{rho}(len)

    Sponge's squeeze operation of len bytes using rho rounds of f

#### H.duplexing(input,len)

    Sponge's duplexing operation on input, producing len bytes

#### H.duplexing_{rho}(input,len)

    Sponge's duplexing operation on input, using rho rounds of f, producing len bytes

#### pad(string)

    Pads a string to a multiple of blen bytes (padding rule: 10*1)

#### lsw(input)

    The least significant word of input

#### len(string)

    Length of a string, in bytes

#### syncThreads

    Synchronize parallel threads

#### swap(input1,input2)

    Swap the value of two inputs

#### C

    Number of columns on the memory matrix (usually, 64, 128, 256, 512 or 1024)

#### P

    Degree of parallelism (P >= 1 and (m_cost/2) % P == 0)

### Algorithm with parallelism
## Security analysis

Against Lyra2, the processing cost of attacks using $1/2^{n+2}$ of the amount of memory employed by a legitimate user is expected to be between $O(2^{2nT}R^{3})$ and $O(2^{2nT}R^{n+2})$, the latter being a better estimate for $n\gg 1$, instead of the $O(R)$ achieved when the amount of memory is $O(R)$, where $T$ is a user-defined parameter to define a processing time.
This compares well to Scrypt, which displays a cost of $O(R^{2})$ when the memory usage is high$O(1)$, and with other solutions in the literature, for which the results are usually $O(R^{T+1})$.
Nonetheless, in practice these solutions usually involve a value of $R$ (memory usage) lower than those attained with the Lyra2 for the same processing time.

## Performance

The processing time obtained with an SSE single-core implementation of Lyra2 is illustrated in the hereby shown figure. This figure was extracted from, and is very similar to, third-party benchmarks performed during the PHC context.
The results depicted correspond to the average execution time of Lyra2 configured with $C=256$, $\rho =1$, $b=768$ bits (i.e., the inner state has 256 bits), and different $T$ and $R$ settings, giving an overall idea of possible combinations of parameters and the corresponding usage of resources.
As shown in this figure, Lyra2 is able to execute in: less than 1 s while using up to 400 MB (with $R=2^{14}$ and $T=5$) or up to 1 GB of memory (with $R\approx 4.2\cdot 10^{4}$ and $T=1$); or in less than 5 s with 1.6 GB (with $R=2^{16}$ and $T=6$).
All tests were performed on an Intel Xeon E5-2430 (2.20 GHz with 12 Cores, 64 bits) equipped with 48 GB of DRAM, running Ubuntu 14.04 LTS 64 bits, and the source code was compiled using GCC 4.9.2.

## Extensions

Lyra offers two main extensions:
* **Lyra2-δ**: Provides more control over the algorithm's bandwidth usage.
* **Lyra2p**: Takes advantage of parallelism capabilities on the user's platform.