5 ms·

Down-voted for pointing out that a salted hash is a better alternative? Weird.

by blueben 17y ago

deleted 17y ago
[deleted]
Chronos 17y ago
Suppose I have a processor that runs at 1GHz, and furthermore suppose that it has a built-in hash primitive that can hash one salt+password in a single clock cycle. Thus, I can try 1 billion passwords per second. That means I can try every item in an English dictionary in merely 0.1 milliseconds, or a very thorough password cracker's dictionary in 2 milliseconds. If a site has 1000 users, I can try the cracker's dictionary against all of them in only 2 seconds. That's less time than it takes for me to browse through the list of password hashes using the scroll wheel on my mouse. For password hashing primitives, speed DOES matter. A lot. What's more, if I could do 1 billion MD5s per second, then I could brute force every possible 8 character base-64 password (for one user at a time) in merely 3.25 days. Even if that one user has chosen his or her individual password by pulling it straight from /dev/random. Impractical against a site with 1000 low-value users? Sure, most black hats won't want to spend 5 to 10 years of compute power on that. But that's an utterly practical attack against a single, high-value account. If you're Twitter and someone just stole your salted password hashes, you'd better ring up Ashton Kutcher in the next 24 hours and tell him to change his password right now. Something truly scary: this level of computer power can be easily achieved today using parallelism. I just now ran a benchmark on my personal Linux machine against 10,000 small files on a ramdisk, each of a size appropriate for salted passwords and each with unique data. According to this benchmark, my Athlon64 running at 800MHz can MD5 100,000 passwords per second using md5sum, complete with the system call overhead of opening and closing ten thousand files. Even so, my machine is only 4 orders of magnitude slower than the monster I described, and one of those orders of magnitude should be written off because my processor is years behind the times (sub-1GHz and single core). Shave off another order of magnitude due to the useless system calls, and one hundred modern $100 commodity processors could do this job today, and you could probably do it for half the price or less if you used DSPs or video card GPUs. This is trivially within the range of a project like Seti@Home or Folding@Home, or a dark-hat version of the same (running on a botnet of stolen CPU cycles). Addendum: also note, these figures imply that one computer with a modern CPU can dictionary attack a salted password hash file from a 1000-user site in merely 200 seconds, i.e. about the time it takes to microwave a burrito. No need to build a botnet first.
oomkiller 17y ago
You are incorrect, and it's why you are being downvoted. Please read this article to learn why: http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-tables-what-you-need-to-know-about-s.html http://chargen.matasano.com/chargen/2007/9/7/enough-with-the... Essentially, MD5 and SHA were designed to be fast hashing algorithms. This is NOT what you want with password hashing, as you need to be able to tune the complexity of your algorithm to scale with Moore's Law and other factors.
ErrantX 17y ago
If you read the post he links to by Tom Ptacek [1] (one of the go-to guys for security around here) you will see the reason this is considered a bad "alternative". He has also discussed this in depth here in the past if you search back over his comments (tptacek) 1. http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-tables-what-you-need-to-know-about-s.html http://chargen.matasano.com/chargen/2007/9/7/enough-with-the...

Down-voted for pointing out that a salted hash is a better alternative? Weird.

by blueben 17y ago

Down-voted for pointing out that a salted hash is a better alternative? Weird.

deleted 17y ago

[deleted]

Chronos 17y ago

Suppose I have a processor that runs at 1GHz, and furthermore suppose that it has a built-in hash primitive that can hash one salt+password in a single clock cycle. Thus, I can try 1 billion passwords per second. That means I can try every item in an English dictionary in merely 0.1 milliseconds, or a very thorough password cracker's dictionary in 2 milliseconds. If a site has 1000 users, I can try the cracker's dictionary against all of them in only 2 seconds. That's less time than it takes for me to browse through the list of password hashes using the scroll wheel on my mouse. For password hashing primitives, speed DOES matter. A lot. What's more, if I could do 1 billion MD5s per second, then I could brute force every possible 8 character base-64 password (for one user at a time) in merely 3.25 days. Even if that one user has chosen his or her individual password by pulling it straight from /dev/random. Impractical against a site with 1000 low-value users? Sure, most black hats won't want to spend 5 to 10 years of compute power on that. But that's an utterly practical attack against a single, high-value account. If you're Twitter and someone just stole your salted password hashes, you'd better ring up Ashton Kutcher in the next 24 hours and tell him to change his password right now. Something truly scary: this level of computer power can be easily achieved today using parallelism. I just now ran a benchmark on my personal Linux machine against 10,000 small files on a ramdisk, each of a size appropriate for salted passwords and each with unique data. According to this benchmark, my Athlon64 running at 800MHz can MD5 100,000 passwords per second using md5sum, complete with the system call overhead of opening and closing ten thousand files. Even so, my machine is only 4 orders of magnitude slower than the monster I described, and one of those orders of magnitude should be written off because my processor is years behind the times (sub-1GHz and single core). Shave off another order of magnitude due to the useless system calls, and one hundred modern $100 commodity processors could do this job today, and you could probably do it for half the price or less if you used DSPs or video card GPUs. This is trivially within the range of a project like Seti@Home or Folding@Home, or a dark-hat version of the same (running on a botnet of stolen CPU cycles). Addendum: also note, these figures imply that one computer with a modern CPU can dictionary attack a salted password hash file from a 1000-user site in merely 200 seconds, i.e. about the time it takes to microwave a burrito. No need to build a botnet first.

oomkiller 17y ago

You are incorrect, and it's why you are being downvoted. Please read this article to learn why: http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-tables-what-you-need-to-know-about-s.html http://chargen.matasano.com/chargen/2007/9/7/enough-with-the... Essentially, MD5 and SHA were designed to be fast hashing algorithms. This is NOT what you want with password hashing, as you need to be able to tune the complexity of your algorithm to scale with Moore's Law and other factors.

ErrantX 17y ago

If you read the post he links to by Tom Ptacek [1] (one of the go-to guys for security around here) you will see the reason this is considered a bad "alternative". He has also discussed this in depth here in the past if you search back over his comments (tptacek) 1. http://chargen.matasano.com/chargen/2007/9/7/enough-with-the-rainbow-tables-what-you-need-to-know-about-s.html http://chargen.matasano.com/chargen/2007/9/7/enough-with-the...