# Lightweight Password Hashing Scheme for Embedded Systems

George Hatzivasilis, Ioannis Papaefstathiou, Charalampos Manifavas, Ioannis Askoxylakis

► To cite this version:

George Hatzivasilis, Ioannis Papaefstathiou, Charalampos Manifavas, Ioannis Askoxylakis. Lightweight Password Hashing Scheme for Embedded Systems. 9th Workshop on Information Security Theory and Practice (WISTP), Aug 2015, Heraklion, Crete, Greece. pp.260-270, 10.1007/978-3-319-24018-3_17. hal-01442548

HAL Id: hal-01442548

https://inria.hal.science/hal-01442548

Submitted on 20 Jan 2017

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Lightweight Password Hashing Scheme for Embedded Systems

George Hatzivasilis<fnref n="1" />, Ioannis Papaefstathiou<fnref n="1" />, Charalampos Manifavas<fnref n="2" />, and Ioannis Askoxylakis<fnref n="3" />

**Abstract.** Passwords constitute the main mean for authentication in computer systems. In order to maintain the user-related information at the service provider end, password hashing schemes (PHS) are utilized. The limited and old-fashioned solutions led the international cryptographic community to conduct the Password Hashing Competition (PHC). The competition will propose a small portfolio of schemes suitable for widespread usage until 2015. Embedded systems form a special application domain, utilizing devices with inherent computational limitations. Lightweight cryptography focuses in designing schemes for such devices and targets moderate levels of security. In this paper, a lightweight poly PHS suitable for lightweight cryptography is presented. At first, we design two lightweight versions of the PHC schemes Catena and PolyPassHash. Then, we integrate them and implement the proposed scheme – called LightPolyPHS. A fair comparison with similar proposals on mainstream computer is presented.

**Keywords:** password hashing · PHC · Catena · PolyPassHash · lightweight cryptography · LWC · embedded systems

## 1 Introduction

Attacks on widely known organizations have exposed mounts of user accounts and credentials. The poor password protection practises are exploited by the attackers in order to recover the user passwords from the stolen data. These attacks lead to negative and significant loss in the vendor's market value.

Advanced password hashing schemes (PHS) are proposed to fortify the secure maintenance of such information. PBKDF2 [1], bcrypt [2] and scrypt [3] are currently the most common solutions. However, the evolving parallel computing

<footnote n="1">¹ Dept. of Electronic & Computer Engineering, Technical University of Crete, Chania, Crete, Greece
gchatzivasilis@isc.tuc.gr, ygp@mhl.tuc.gr</footnote>

<footnote n="2">² Dept. of Informatics Engineering, Technological Educational Institute of Crete, Heraklion, Crete, Greece
harryman@ie.teicrete.gr</footnote>

<footnote n="3">³ Foundation for Research and Technology – Hellas (FORTH), Heraklion, Crete, Greece
asko@ics.forth.gr</footnote>
and hardware dedicated devices enable attacks [4] that overcome the PHS pro-
tection. GPUs, FPGAs and ASICs implement efficient password crackers that try
out several attempts in parallel, gaining a significant boost in disclosing the user
information. PBKDF2 and bcrypt are vulnerable to such attacks. Memory-hard
PHSs can counter password scrambling. The memory elements in parallel plat-
forms are considered expensive. All parallel components share the same memory
and the access to it is bounded. Thus, attackers are significantly slowed-down
when PHSs with high memory requirements are applied. The goal is to derive
password scrambling on parallel cores not much faster than it is on single cores.
scrypt is the current solution of memory-hard PHS. Unfortunately, it is vulnera-
ble to other attacks, like cache-timing [5] and garbage-collector [6]. The limited
and old-fashioned solutions led the international cryptographic community to
conduct the Password Hashing Competition (PHC) [7] in 2013. It targets in
modern and secure designs for password hashing, with 22 initial candidates be-
ing submitted. In 2014, 9 finalists were selected based on security, efficiency,
simplicity, and the extra features that they provide. A comprehensive survey
and benchmark analysis of the 22 PHC submissions and the 3 current solutions
for password hashing is presented in [7]. In 2015, a small portfolio of schemes
will be announced based on further performance and security analysis. The win-
ers are expected to become "de facto" standards and be further examined by
organizations like NIST for formal standardization.

PHSs are applied in several domains (e.g. general applications on mainstream
computers, web applications and embedded systems) with diverse features and
properties. The candidate scheme must comply with them. Typically, a PHS uti-
lizes core cryptographic primitives, such as block ciphers and hash functions, that
constitute the main computational components of the scheme. The mainstream
cryptographic solutions provide high levels of security, ignoring the requirements
of resource constrained devices. The research field of lightweight cryptography
(LWC) [8, 9] focuses in designing schemes for devices with constrained capabili-
ties in processing, power supply, connectivity, hardware and software. They are
mainly applied in embedded systems [10] that are deployed in pervasive and
ubiquitous computing [11–13]. Security is just a part of the whole functionality
and the lightweight designs consume low computational resources and memory.
In case of most constraint devices (e.g. sensors) only a few KBs of memory are
devoted to provide moderate level of security [14]. Regarding passwords, embed-
ded systems maintain a small amount of authentication-related data. Device-
to-device and short-term communication forms the most common interaction
(e.g. in wireless sensor networks), making session key deviation from passwords
a desirable goal to enhance security. The garbage-collector attacks [6] can be
countered by build-in memory safety techniques [15].

In this paper, we present LightPolyPHS – a lightweight poly PHS for em-
bedded devices and LWC. To our knowledge this is the first scheme that targets
constrained devices. Section 2, introduces the background theory and related
work regarding passwords and LWC. Section 3, analyses the LightPolyPHS de-
sign and its subcomponents. In section 4, the proposed scheme is applied and
evaluated on real embedded devices. A comparative analysis is held with similar
schemes on mainstream computers. Finally, section 5 concludes.

2 Background Theory and Related Work

2.1 Password Hashing

User passwords are human-memorable secrets, consisting of 8-12 printable char-
acters and form the main mean for authentication in computer systems. The
service provider maintains a pair of the user's name and password-related infor-
mation for each active account. To authenticate himself and login the service,
the user must inputs this information first. Passwords can also be used for the
generation of cryptographic keys. Key Deviation Functions (KDF) [16] parse a
password and derive one or more related keys. The keys are used on crypto-
graphic operations, like session encryption. Ordinary passwords are 8 characters
long (8 bytes). The deriving secrets may produce low entropy and be vulnerable
to relative attacks. In exhaustive search, an attacker tries out all character com-
binations until he finds the right password. Then, he owns the relevant account,
like the legitimate user does.

The typical method to counter these attacks with PHSs, is key stretching.
A hash function parses the password and produces a fixed-length output, acting
as the new password. The hash password is longer (usually 32-64 bytes long),
making the attacks less feasible. The hash function is iterating several times
to further fortify the hash result. The attacker is slowed down by a factor of
$2^{i+o}$, where i is the iteration count and o is the number of the output bits.
However, the user is also slowed down. Thus, the key stretching parameters are
also bounded by the user's tolerance to compute a robust hash password. In
modern services, a high volume of users must be verified simultaneously. The
load on the server may become unmanageable and lead to denial of service.
Server relief (SR) protocols are established and balance the total effort between
clients and the server. A client may perform part of the PHS computations
while the server performs the rest steps and the account verification. The server
might need to increase security (e.g. increase the hash size or PHS iterations).
Hash password upgrade techniques independent from the user (HUIU) enhances
the convenience of the user and enables the seamless operation of the service.
The server upgrades the security of the stored hash passwords without prior-
knowledge of the initial passwords or the user's involvement. It is quite common
for a user to utilize the same password in different services or many users of a
service to have the same password. The hash passwords would be the same too.
The disclosure of a single account erases security issues for the rest ones. To
prevent this correlation a small parameter of random bytes, called salt (usually
8 bytes long), is utilized. The salt also hardens dictionary (try hundreds of likely
possibilities to determine the secret) [5] and rainbow table attacks (ability to
use tables of precomputed hashes) [6]. Typically, the salt is generated when the
user account is created and is concatenated with the password during hashing.
Thus, the same password produces different hash passwords. At the server-end,
the salt is stored in plaintext along with the hashed password. They are used in
the authentication process to validate the password of a login request.

## 2.2 Poly Password Hashing

Strong PHS can protect the password data that are maintained at the service-end. However, attackers have proven themselves adept at cracking large amounts of passwords once the stored data is compromised. To further fortify security, poly (many) password hashing (PPH) schemes have been recently proposed. They leverage cryptographic hashing and threshold cryptography by combining strong PHS with shares.

Cryptographic hashing and PHSs are described in the previous subsection. A cryptographic $(k, n)$-threshold scheme protects secret information, by deriving $n$ different shares from this information. The threshold determines how any $k$ shares out of total $n$ can recover the secret information. If fewer than $k$ shares are known, no secret information is disclosed. The Shamir Secret Sharing (SSS) [17] is a fundamental threshold scheme in this domain. It computes $k-1$ random coefficients for a $k-1$ degree polynomial $f(x)$ in a finite field. The $k$th term comprises the secret (usually the constant term of the polynomial). The share is identified by a share value $x$, taking values between 1 and the order of the field. The share $x$ is the polynomial value of $f(x)$. The secret can be reconstructed by interpolating the values of $k$ shares to find the constant term of the polynomial (i.e., the secret). Interpolation is computationally optimized and only the constant term is revealed.

In the PPH domain, there is one share for each account. The share is XORed with the relevant PHS result and is maintained by the server (instead of the pure PHS result). The shares are derived from a master key. This key is only known to the service provider and is not stored on disk in order to prevent attacks that would disclose the key along with the stolen password data. When the server starts, $k$ clients must login and be correctly verified in order to reconstruct the shares. Implementations of SSS provide integrity check mechanisms to detect if incorrect shares are parsed. After this startup phase, the server operates in the ordinary manner. The attacker has to crack a threshold of password hashes before being able to recover passwords. At a small additional cost by the server, security increases by many orders of magnitude. Poly password hashing is easily implemented and deployed on a server without any changes to clients and can be integrated to current forms of authentication (e.g. two factor authentication and hardware tokens). It is also efficient in terms of storage, memory and computational demands.

## 2.3 Password Hashing Competition

Secure cryptographic hash functions or HMACs constitute the most common solution for PHSs and KDFs. PBKDF2, bcrypt and scrypt are currently the widely-used PHSs and KDFs for mainstream applications. The Password-Based Key Derivation Function 2 (PBKDF2) [1] is the only standardized scheme (RSA
Laboratories' Public-Key Cryptography Standards (PKCS) series (PKCS #5 v2.0) and the RFC 2898). The input password and salt are processed by an HMAC. PBKDF2 is not memory-hard and can be implemented as a small circuit with low RAM requirements. This is evinced in a main drawback as cheap brute-force attacks are enabled on GPUs and ASICs. bcrypt [2] is based on the block cipher Blowfish [18] and is the default PHS of the BSD operating system. It uses 4KB RAM and is slightly stronger than PBKDF2 in defending attacks on parallel computing platforms and dedicated hardware devices. However, these memory requirements render efficient attacks on FPGAs. scrypt [3] was announced as an Internet Draft by the IETF in 2012, with the intention to become an informational RFC. It utilizes the PBKDF2 and the stream cipher Salsa [19] and uses arbitrarily large amounts of memory. scrypt is the most resistant widely-used scheme. The cost of a hardware brute force attack is considered around 4000 and 20000 times larger than in bcrypt and PBKDF2 respectively. However, the huge memory requirements can derive denial-of-service (DoS) attacks on servers, when large amounts of simultaneous login requests are handled. Also, scrypt is vulnerable to new types of attacks, like cache-timing [5] and garbage-collector attacks [6].

Password Hashing Competition (PHC) [7] advances our knowledge in designing secure and efficient PHSs and KDFs. At the first round 22 new PHSs were evaluated in terms of security, performance and flexibility. A survey and benchmark analysis of the 3 aforementioned widely-used PHSs and the 22 candidates is presented in [7]. The parameters t_cost and m_cost are introduced to adjust the timing and memory requirements respectively. The defender adjusts the PHS iteration count and memory requirements to design secure schemes. The finalist Catena is one of the most notable submissions and is intended to be included in the winners list. It implements the full functionality of PHS, KDF, SR, and HUIU, is well-documented and analysed, and is one of the most efficient candidate in terms of execution time and memory usage. Catena exhibits low code size and memory requirements, making it suitable for embedded systems. A PPH scheme, called PolyPassHash, is also presented in the competition. It is actually a protocol that recovers a symmetric key used to encrypt passwords and does not constitute a pure PHS. Thus, it is not included in the finalists. Still, PolyPassHash demonstrates state-of-the-art features regarding PPH and is efficient in terms of storage, memory and computational requirements. We utilize the PHC candidates Catena and PolyPassHash to design our lightweight proposal. Both schemes are analysed in the following section.

## 2.4 Lightweight Cryptographic Mechanisms

Traditional cryptography targets high level of security. The main primitive types that are investigated in this paper include block ciphers and hash functions. The block cipher AES[20] is considered a landmark in this field. Standardized or widely-used hash functions for mainstream applications are SHA2[21] and BLAKE[22]. However, these mainstream ciphers and functions are too large to fit in many types of embedded systems.
Lightweight cryptography (LWC) [14] focuses in designing cryptographic primitives for resource constraint devices. The main design goals in software are the reduction of processing and memory requirements. Embedded software implementations are optimized for throughput as well as memory and power savings. Lightweight primitives provide moderate levels of security from 80 to 128 bits. 80 bit security is adequate for constrained devices, like RFID tags and micro-controllers, while 128 bits is typical for mainstream applications. In recent years, a high variety of lightweight proposals are presented [14]. The standardized primitives for LWC are referred in the ISO/IEC standard 29192 [23]. The part 2 of the standard includes block ciphers and the upcoming part 5 includes hash functions. Regarding embedded software, CLEFIA [24], designed by SONY, is the standardized block cipher and PHOTON [25] is a lightweight hash function considered for inclusion in the standard. The proposed LightPolyPHS scheme utilizes CLEFIA for cryptographic operations and PHOTON for hashing.

# 3 Lightweight PHS and PPH

LightPolyPHS is a lightweight PHS and PPH, designed for embedded systems and constrained devices. The overall system complies with the principles of LWC. First, we replace the inner cryptographic primitives that are utilized by the PHS Catena and the PPH PolyPassHash and implement two relevant lightweight schemes. Then, we integrate them by using the lightweight Catena as the PHS for the lightweight PolyPassHash and implement the proposed LightPolyPHS.

## 3.1 Mainstream and Lightweight Catena PHS

Catena is suitable for multiple environments, like multi-core CPUs, databases, and low-memory devices. It is a composed cryptographic operation based on a cryptographic hash function and is simple and easy to analyse. The design constitutes a graph-based structure, called "Bit-Reversal Graph", that is instantiated by the cryptographic hash function. Any strong hash function can be embodied. The reference implementation selects SHA512 and BLAKE2b. SHA512 is standardized and widely-implemented in many platforms. BLAKE2b supports the Simple Instruction Multiple Data (SIMD) approach and protects massively parallel attacks on GPUs. The scheme is well-documented with thorough security analysis. The time-memory tradeoff analysis is based on the pebble-game approach [6]. Catena provides lower bounds on the time-memory tradeoff, preimage security, indistinguishability from random and resistance against side-channel (e.g. cache-timing attacks [5]). The computational cost for massively parallel crackers on GPUs, ASICs and FPGAs is high.

The lightweight Catena utilizes PHOTON-256 as the cryptographic hash function, which outputs a 256-bit digest. This results in a smaller datapath and implementation size than the original scheme as well as lower computational and memory requirements. The output size complies with the relevant primitive in PolyPassHash and provides moderate level of security. The security level of the
Catena is determined by the underlying hash function. Consider that Catena-sha512, Catena-blake2b and Catena-photon256 offer $2^{512}$, $2^{481}$ and $2^{244}$ bits security respectively.

## 3.2 Mainstream and Lightweight PolyPassHash PPH

PolyPassHash is a PPH scheme that provides protection above PHS. It is composed of two building blocks: the aforementioned SSS threshold scheme and the standardized SHA256 [21] hash function. The computational complexity of SSS is based on the $k$ degree polynomial over a finite field. For PolyPassHash, the default $k$ value is 3 and it is assigned as the *t_cost* parameter. SHA256 simple parses the password and the salt. The hashes are also encrypted with the AES. At the server-side, PolyPassHash processes the password file when the system restarts. Then, a threshold of users must login before the passwords can be verified. After startup, the login requests are processed with similar computational overhead as in PHS-only systems. The memory overhead is about 1KB independent of the number of passwords and the storage cost is one byte per user account (the share value). An alternative partial verification process is also supported that allows users to login immediately after the restart without the need to verify a threshold of users. No modification of the client applications or the login process is required. PolyPassHash is solely based on software and the system administrator can adjust the threshold value without affecting the users. The attacker must guess 3 passwords simultaneously. On GPUs, PolyPassHash imposes about 23 orders of magnitude more effort than on PHS-only systems. On CPUs, even a threshold of 2 secrets provides sufficient security.

The lightweight PolyPassHash replaces SHA256 with the lightweight PHOTON256. AES is substituted by CLEFIA with the same key size. The two schemes exhibit the same datapath size and the resource saving is low. The security level of the lightweight version is similar to the original one. In both schemes, the disk space requires 1 additional byte for each account to store the share value, in contrast to PHS-only solutions. The server must also store the polynomial coefficients for the SSS in memory. The total size is small: the XORed share and hash (256 bits long) multiplied by the threshold value (usually 2-5). In real systems, this value would result in a few hundred bytes.

## 3.3 Mainstream and Lightweight PolyPHS

In PolyPassHash, passwords are simply parsed by SHA256. To further increase security, we replace the hash function with the Catena PHS. The PHS enhances resistance against attacks but is more resource demanding than SHA256. Also, Catena exhibits larger output size (512-bits) and the integrated implementation size is higher.

The original Catena offers high level of security but it can not be applied on constrained devices. The lightweight Catena offers moderate level of security and is appropriate for the targeted systems. To fill the gap, the lightweight PolyPassHash is applied to increase security. The simple hash function is replaced
by the PHS. Lightweight Catena uses the same datapath size as the SHA256
of PolyPassHash and provides higher password protection. With 3 shares as the
threshold, an attacker must guess 3 lightweight-Catena passwords simultaneously
to recover the password file. The security level is increased by 23 magnitudes on
GPUs, resulting in $2^{244} * 10^{23} \approx 2^{320}$ bits security.

4 Evaluation

The examined PHSs, PPHs, and the core cryptographic primitives are evalu-
ated under an Intel Core i7 at 2.10GHz CPU with 8GB RAM, running 64-bit
operating systems. Reference C or C++ implementations are utilized in order
to provide a fair comparison with the unoptimized versions of PHC. All imple-
mentations are installed on Windows 8.1 Pro and are executed on cygwin. The
different primitives are assessed under common assumptions. We measure the
code size, memory consumption, execution time and throughput of each scheme.

Table 1 summarizes the software evaluation of the examined PHSs and PPHs
based on the default sizes for output, password and salt, and the indicative *t_cost*
and *m_cost* parameters as reported by each scheme. The standardized PBKDF2
is not memory-hard and consumes neglected memory. bcrypt has low mem-
ory requirements and achieves similar performance as scrypt. scrypt is the first
widely-used memory-hard PHS and exhibits the higher memory consumption
and larger implementation size. Catena is a novel PHS that applies memory
hardness to enhance security. Three versions are evaluated based on the under-
lying hash function. Catena-blake2d is the fastest and consumes similar memory
as Catena-sha512. Catena-photon256 reduces memory demandings around 50%
in exchange of lower performance. All three versions produce similar code size.
PolyPassHash is a novel PPH that utilizes the hash function SHA256 and the
block cipher AES. It is quite efficient and has low and constant memory require-
ments. The Light-PolyPassHash version uses the hash function PHOTON and
the block cipher CLEFIA. It decreases the code size and accomplishes slightly
lower memory consumption and worsen speed.

The security of the initial scheme is fortified by replacing the hash function
with a PHS. The PHS constitutes the most resource demanding component. The
*t_cost* parameter determines the *k* shares of the SSS component and linearly af-
fects the execution time. As *t_cost* increases, the number of password hashing
operations, which are performed by the PHS, also increases. PolyPHS uses the
Catena-blake2b (*t_cost* = 3, *m_cost* = 18) as the PHS of PolyPassHash. Light-
PolyPHS uses the Catena-photon256 (*t_cost* = 3, *m_cost* = 18) as the PHS of
Light-PolyPassHash.

Figure 1, illustrates the evaluation results of the 10 PHS and PPH schemes.
For *k* = 2, LightPolyPHS has slightly worsen performance than bcrypt and
scrypt. The memory-hard Catena-photon256 component enhanced with the SSS
provide adequate security for around 39 times lower memory consumption and
2.3 smaller implementation size than scrypt.
<figure><img src="image_2.png" /><figcaption>Fig. 1. Comparison of the examined PHSs</figcaption></figure>

<table><caption>Table 1: Software implementations of PHSs and PPHS</caption><thead><tr><th>PHS</th><th>Password (bytes)</th><th>Salt (bytes)</th><th>Output (bytes)</th><th>t_cost</th><th>m_cost</th><th>ROM (KB)</th><th>RAM (KB)</th><th>CPU (secs)</th></tr></thead><tbody><tr><td>PBKDF2</td><td>24</td><td>8</td><td>64</td><td>1000</td><td>0</td><td>30</td><td>0</td><td>0.002024</td></tr><tr><td>PBKDF2</td><td>24</td><td>8</td><td>64</td><td>2048</td><td>0</td><td>30</td><td>0</td><td>0.004150</td></tr><tr><td>bcrypt</td><td>12</td><td>16</td><td>54</td><td>12</td><td>0</td><td>27</td><td>492</td><td>2.668653</td></tr><tr><td>scrypt</td><td>8</td><td>32</td><td>64</td><td>5</td><td>0</td><td>182</td><td>450656</td><td>2.837654</td></tr><tr><td>Catena-blake2b</td><td>8</td><td>16</td><td>64</td><td>3</td><td>18</td><td>25</td><td>16384</td><td>0.353742</td></tr><tr><td>Catena-blake2b</td><td>8</td><td>16</td><td>64</td><td>3</td><td>20</td><td>25</td><td>65596</td><td>2.619238</td></tr><tr><td>Catena-sha512</td><td>8</td><td>16</td><td>64</td><td>3</td><td>18</td><td>25</td><td>16496</td><td>0.783590</td></tr><tr><td>Catena-sha512</td><td>8</td><td>16</td><td>64</td><td>3</td><td>20</td><td>25</td><td>65720</td><td>5.389355</td></tr><tr><td>Catena-photon256</td><td>8</td><td>16</td><td>32</td><td>3</td><td>18</td><td>26</td><td>8188</td><td>1.749200</td></tr><tr><td>Catena-photon256</td><td>8</td><td>16</td><td>32</td><td>3</td><td>20</td><td>26</td><td>32760</td><td>13.065627</td></tr><tr><td>PolyPassHash</td><td>16</td><td>16</td><td>32</td><td>2</td><td>0</td><td>78</td><td>3412</td><td>0.000055</td></tr><tr><td>PolyPassHash</td><td>16</td><td>16</td><td>32</td><td>2</td><td>0</td><td>78</td><td>3412</td><td>0.000055</td></tr><tr><td>Light-PolyPassHash</td><td>16</td><td>16</td><td>32</td><td>2</td><td>0</td><td>66</td><td>3410</td><td>0.000068</td></tr><tr><td>Light-PolyPassHash</td><td>16</td><td>16</td><td>32</td><td>2</td><td>0</td><td>66</td><td>3410</td><td>0.000080</td></tr><tr><td>PolyPHS</td><td>16</td><td>16</td><td>64</td><td>2</td><td>0</td><td>89</td><td>19794</td><td>0.707538</td></tr><tr><td>PolyPHS</td><td>16</td><td>16</td><td>64</td><td>2</td><td>0</td><td>89</td><td>19794</td><td>1.415020</td></tr><tr><td>LightPolyPHS</td><td>16</td><td>16</td><td>32</td><td>2</td><td>0</td><td>77</td><td>11579</td><td>3.498454</td></tr><tr><td>LightPolyPHS</td><td>16</td><td>16</td><td>32</td><td>2</td><td>0</td><td>77</td><td>11579</td><td>6.996854</td></tr></tbody></table>

## 5 Conclusions

The maintenance of user passwords constitutes a significant factor related to the provided security of a service. Security breaches on famous applications have reveal massive amounts of user data, harming the reliability of their providers. The poor password hashing techniques and the limited available solutions lead the international cryptographic community to organize the Password Hashing Competition (PHC). The competition intends to delivery a small portfolio of modern and secure schemes for password hashing and key deviation. This paper presents the LightPolyPHS - a lightweight poly password hashing scheme for embedded systems and lightweight cryptography. We held a comparative analysis with similar schemes on a mainstream computer. LightPolyPHS is the first lightweight password hashing and poly password hashing scheme suitable for constrained devices. Compared to current solutions it requires around 39 times less memory and 2.3 times smaller code size.

## References

1. Kaliski, B., RSA Laboratories: RFC 2898 - PKCS #5: Password-Based Cryptography Specification Version 2.0. Technical report, IETF, 2000 (2000)

2. Provos, N., Mazires, D.: A Future-Adaptable Password Scheme, USENIX Annual Technical Conference, pp. 8192 (1999)
3. Colin Percival. Stronger Key Derivation via Sequential Memory-Hard Functions. presented at BSDCan09, May 2009 (2009)

4. Orman, H: Twelve Random Characters: Passwords in the Era of Massive Parallelism, IEEE Internet Computing, vol. 17, issue 5, 2013, pp. 91-94 (2013)

5. Forler, C., Lucks, S., Wenzel, J.: Catena: A memory-consuming password scrambler, Cryptology ePrint Archive, Report 2013/525 (2013)

6. Forler, C., Lucks, S., Wenzel, J.: The Catena Password Scrambler, PHC submission, May 15, 2014 (2014)

7. Hatzivasilis, G., Papaefstathiou, I., Manifavas, C.: Password Hashing Competition – Survey and Benchmark, Cryptology ePrint Archive, Report 2015/265 (2015)

8. Hatzivasilis, G., Theodoridis, A., Gasparis, E., Manifavas, C.: ULCL: an Ultra-Lightweight Cryptographic Library for embedded systems, MeSeCCS, PECCS, 2014, Lisbon, Portugal (2014)

9. Hatzivasilis, G., Floros, G., Papaefstathiou, I., Manifavas, C.: Lightweight authenticated encryption for green networking, IEEE AFRICON 2015 Green innovation for African renaissance, IEEE, Addis Ababa, Ethiopia, 2015 (2015)

10. Fysarakis, K., Hatzivasilis, G., Rantos, K., Papanikolaou, A., Manifavas, C.: Embedded systems security challenges, MeSeCCS, PECCS, Lisbon, Portugal (2014)

11. Petroulakis, N. E., Askoxylakis, I. G., Traganitis, A., Spanoudakis, G.: A privacy-level model of user-centric cyber-physical systems, HCI, pp. 338-347 (2013)

12. Iris, V., Askoxylakis, I., Conti, M., Bruno, R.: Enhanced, ubiquitous and dependable broadband access using MESH networks, ERCIM News, vol. 73 (2008)

13. Markantonakis, K., Mayes, K., Sauveron, D., Askoxylakis, I. G.: Overview of security threats for smart cards in the public transport industry, IEEE International Conference on e-Business Engineering, IEEE, 2008, pp. 506-513 (2008)

14. Manifavas, C., Hatzivasilis, G., Fysarakis, K., Rantos, K.: Lightweight cryptography for embedded systems: a comparative analysis, SETOP, ESORICS, Springer, LNCS, vol. 8247, 2013, pp. 333-349. (2013)

15. Dhunjati, D., Kowshik, S., Adve, V., Lattner, C.: Memory safety without garbage collection for embedded applications, ACM TECS, vol. 4 (1), 2005, pp. 73-111 (2005)

16. NIST: Recommendation for Password-Based Key Derivation, NIST Special Publication 800-132, December 2010. (2010)

17. Shamir, A.: How to share a secret, Communications of the ACM, vol. 22, no. 11, 1979, pp. 612-613 (1979)

18. Schneier, B.: Description of a New Variable-Length Key, 64-Bit Block Cipher (Blowfish), FSE, Springer, LNCS, vol. 809, 1994, pp. 191-204 (1994)

19. Bernstein, D.J.: The Salsa20 family of stream ciphers, eSTREAM project (2007)

20. Moradi, A., Poschmann, A., Ling, S., Paar, C., Wang, H.: Pushing the Limits: a Very Compact and a Threshold Implementation of AES. EUROCRYPT, vol. 6632, 2011, pp. 69 (2011)

21. NIST: Secure Hash Standard, FIPS 180-2, April 1995. (1995).

22. Aumasson, J.-P., Neves, S., Wilcox-O'Hearn, Z., Winnerlein, C.: BLAKE2: Simpler, Smaller, Fast as MD5, ACNS, Springer, LNCS, vol. 7954, 2013, pp 119135 (2013)

23. ISO/IEC 29192:2012, International standard for lightweight cryptographic methods, ISO/IEC (2012)

24. Akishita, T., Hiwatari, H.: Very Compact Hardware Implementations of the Block-cipher CLEFIA, Sony Corporation, Technical Paper (2011)

25. Guo, J., Peyrin, T., Poschmann, A.: The PHOTON Family of Lightweight Hash Functions. CRYPTO, LNCS, vol. 6841, 2011, pp. 222-239 (2011)

26. Guo, J., Karpman, P., Nikolic, I., Wang, L., Wu, S.: Analysis of Blake2, Cryptology ePrint Archive, Report 2013/467 (2013)