Announcing AURA: Crypto For The Edge

For more than a decade, password hashing and key derivation on the web have relied on symmetric complexity: algorithms like PBKDF2, bcrypt, scrypt, and Argon2id require the verifying server or client to expend the exact same memory and compute resources that an attacker would spend when testing a candidate password.

On traditional monolithic servers, this symmetry was an acceptable trade-off. But on the modern distributed edge-where requests are executed in lightweight V8 isolates, Cloudflare Workers, and mobile client browsers-symmetric memory hardness introduces critical architectural failures:

• Denial-of-Service & Out-Of-Memory Risks: Allocating 64MB of RAM per verification on a serverless worker causes memory limit breaches, cold-start latency spikes, and severe request queue saturation.
• Asymmetric Hardware Economics: Attackers armed with custom FPGA clusters or high-bandwidth GDDR6 memory buses enjoy orders of magnitude higher memory bandwidth than a single CPU core in a sandboxed isolate, allowing them to test millions of passwords per second while legitimate users struggle with sluggish login latency.

To resolve this fundamental tension, Epoch32 is proud to release AURA (Asymmetric Unkeyed-Resistant Algorithm).

The reference implementation is open-source, zero-dependency, and available today at github.com/Epoch32/aura.

What is an Asymmetric Memory-Hard Function (aMHF)?

AURA decouples verification cost for legitimate users from the cost imposed on offline brute-force attackers.

By embedding an algebraic O(1) trapdoor shortcut directly into the memory matrix generation pipeline, AURA establishes a radical asymmetric performance profile:

• Legitimate Prover (With Hardware Key): When a user verifies with a secret derived from a hardware passkey (via the W3C WebAuthn PRF extension) or a server-side KMS enclave, verification evaluates via the algebraic trapdoor shortcut in 0.32 ms (O(1) complexity). Physical RAM allocation is 0 KB.
• Offline Attacker (Without Hardware Key): An attacker who dumps a database and attempts to guess passwords offline does not possess the hardware PRF key. They are mathematically forced to traverse the entire 2-phase memory Directed Acyclic Graph (DAG) across multi-megabyte matrices, taking 58.77 ms (181× slower) and consuming 8 MB of physical RAM per thread per attempt.

Mathematical Architecture

AURA is engineered from first principles with zero external dependencies and zero WebAssembly overhead, relying solely on standard TypedArrays and crypto.subtle.

1. 2D Block Permutation Algebra

Every 1024-byte block in the memory arena is divided into 256 words of 32-bit unsigned integers. Rather than using slow 64-bit operations that degrade in JavaScript engines, AURA employs 32-bit Add-Rotate-XOR (ARX) quarter-rounds:

a = (a + b) mod 2^32;  d = (d ^ a) <<< 16

c = (c + d) mod 2^32;  b = (b ^ c) <<< 12

a = (a + b) mod 2^32;  d = (d ^ a) <<< 8

c = (c + d) mod 2^32;  b = (b ^ c) <<< 7

Diffusion is executed across rows, 64-word column strides, and cross-diagonals, guaranteeing that every single output bit depends non-linearly on every input bit across the block.

2. Quadratic Index Biasing (TMTO Defense)

In traditional memory-hard functions, linear indexing allows attackers to perform Time-Memory Trade-Off (TMTO) attacks: discarding 75% of computed blocks and recomputing them on-demand with minimal time penalties.

AURA prevents TMTO graph-pebbling shortcuts by enforcing quadratic non-uniform window mapping:

x = ⌊(J · J) / 2³²⌋ mod 2³²

y = ⌊(W · x) / 2³²⌋

offset = W - 1 - y

This distribution heavily biases block references toward the most recently generated nodes in the DAG. As proven in computational complexity literature (*Alwen & Blocki, 2017*), evicting recent blocks under quadratic distribution results in exponential recomputation penalties, mathematically proving that an adversary cannot reduce physical memory consumption without suffering massive runtime deceleration.

3. Masked Vault Mode

In high-assurance environments, AURA supports Masked Vault Mode. When sealing a secret, the DAG output D is blinded with a pseudo-random keystream generated via HKDF under the hardware key:

D_stored = D ⊕ HKDF-SHA256(K, S, "aura:vault:mask")

In this mode, offline dictionary search is not merely slow-it is information-theoretically impossible. Without the hardware key K, the stored envelope D_stored is computationally indistinguishable from uniform random noise.

Benchmark Comparison

Benchmarked on Linux x86_64 running Bun 1.4.2 and native WebCrypto:

Open Source & Availability

AURA is available today as an open-source package published under the Mozilla Public License 2.0 (MPL-2.0):

• GitHub Repository: https://github.com/Epoch32/aura
• Package Name: @epoch32/aura
• Zero Dependencies: Pure TypeScript, zero WASM, zero native C-bindings.

You can install it directly in your project:

bun add github:epoch32/aura

# or

npm install github:epoch32/aura

AURA represents the first milestone in Epoch32’s mission to reconstruct the foundations of edge-native systems engineering. We welcome cryptographic review, formal verification, and community feedback.

References

Abusalah, H., Fuchsbauer, G., & Pietrzak, K. (2019). Trapdoor proofs of work and their applications. In A. Boldyreva & D. Micciancio (Eds.), Advances in Cryptology – CRYPTO 2019 (Lecture Notes in Computer Science, Vol. 11692, pp. 3–32). Springer. https://doi.org/10.1007/978-3-030-26948-7_1

Alwen, J., Blocki, J., & Harsha, B. (2017). Tight complexity bounds for parallel graph pebbling and memory-hard functions. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (pp. 1109–1126). Association for Computing Machinery. https://doi.org/10.1145/3133956.3134045

Bernstein, D. J. (2008). The ChaCha family of stream ciphers. In Selected Areas in Cryptography (pp. 1–14). https://cr.yp.to/snuffle.html

Biryukov, A., Dinu, D., & Khovratovich, D. (2016). Argon2: New generation of memory-hard functions for password hashing and other applications. In 2016 IEEE European Symposium on Security and Privacy (EuroS&P) (pp. 388–402). IEEE. https://doi.org/10.1109/EuroSP.2016.31

Biryukov, A., Dinu, D., Josefsson, S., & Khovratovich, D. (2021). Argon2 memory-hard function for password hashing and proof-of-work applications (RFC 9106). Internet Engineering Task Force. https://doi.org/10.17487/RFC9106

Biryukov, A., & Khovratovich, D. (2015). Tradeoff attacks on memory-hard functions (Cryptology ePrint Archive Report 2015/227). International Association for Cryptologic Research. https://eprint.iacr.org/2015/227

Biryukov, A., & Khovratovich, D. (2016). Asymmetric proof-of-work based on the generalized birthday problem. Ledger, 1, 35–48. https://doi.org/10.5195/ledger.2016.48

Corrigan-Gibbs, H., Boneh, D., & Schechter, S. (2014). Inaccessible entropy: A framework for memory-hard functions. In P. Q. Nguyen & E. Oswald (Eds.), Advances in Cryptology – EUROCRYPT 2014 (Lecture Notes in Computer Science, Vol. 8441, pp. 356–373). Springer. https://doi.org/10.1007/978-3-642-55220-5_20

Kaliski, B. (2000). PKCS #5: Password-based cryptography specification version 2.0 (RFC 2898). Internet Engineering Task Force. https://doi.org/10.17487/RFC2898

Percival, C. (2009). Stronger key derivation via sequential memory-hard functions. In Proceedings of BSDCan 2009. The Tarsnap Project. https://www.tarsnap.com/scrypt/scrypt.pdf

World Wide Web Consortium. (2024). Web authentication: An API for accessing public key credentials level 3 (W3C Candidate Recommendation Draft). W3C. https://www.w3.org/TR/webauthn-3/#sctn-prf-extension