Lyra2

Lyra2 is a password hashing scheme (PHS) that can also work as a key derivation function (KDF). It received a special recognition during the Password Hashing Competition in July 2015, which was won by Argon2. Besides being used for its original purposes, it is also in the core of proof-of-work algorithms such as Lyra2REv2, adopted by Vertcoin, MonaCoin, among other cryptocurrencies Lyra2 was designed by Marcos A. Simplicio Jr., Leonardo C. Almeida, Ewerton R. Andrade, Paulo C. F. dos Santos, and Paulo S. L. M. Barreto from Escola Politécnica da Universidade de São Paulo. It is an improvement over Lyra, previously proposed by the same authors. Lyra2 preserves the security, efficiency and flexibility of its predecessor, including: (1) the ability to configure the desired amount of memory, processing time and parallelism to be used by the algorithm; and (2) the capacity of providing a high memory usage with a processing time similar to that obtained with scrypt. In addition, it brings the following improvements when compared to its predecessor:

• it allows a higher security level against attack venues involving time-memory trade-offs
• it allows legitimate users to benefit more effectively from the parallelism capabilities of their own platforms
• it includes tweaks for increasing the costs involved in the construction of dedicated hardware to attack the algorithm
• it balances resistance against side-channel threats and attacks relying on cheaper hence, slower storage devices
• Lyra2 is released under public domain, and provides two main extensions:
• Lyra2-δ, gives the user better control over the algorithm's bandwidth usage
• Lyra2p, takes advantage of parallelism capabilities on the legitimate user's platform

This algorithm enables parameterization in terms of:

• execution time (time cost ${\displaystyle T}$)
• memory required (number of rows ${\displaystyle R}$, and number of columns ${\displaystyle C}$)
• degree of parallelism (number of threads ${\displaystyle p}$)
• underlying permutation function (can be seen as the main cryptographic primitive)
• number of blocks used by the underlying permutation function (bitrate)
• number of rounds performed for the underlying permutation function (${\displaystyle \rho }$)
• number of bits to be used in rotations (${\displaystyle \omega }$)
• output length (${\displaystyle \kappa }$)