4 ms·
>Nine quintillion computations; 6,500 years of CPU; 110 years of GPU Is there a rough calculation in terms of today's $$$ cost to implement the attack?
by jasode 10y ago
>Nine quintillion computations; 6,500 years of CPU; 110 years of GPU
Is there a rough calculation in terms of today's $$$ cost to implement the attack?
- scrollaway 10y agoThe PDF says: > Using a p2.16xlarge instance, featuring 16 K80 GPUs and nominally costing US 14.4 per hour would cost US 560 K for the necessary 71 device years
- jasode 10y agoThank you. It took me a while to realize that the paper you're citing is not directly linked in the Google blog article. It is actually found at shattered.io: http://shattered.io/static/shattered.pdf http://shattered.io/static/shattered.pdf
- milge 10y agoProbably peanuts to any 3 letter government agency.
- prefect42 10y ago71 device years, on an p2.16xlarge instance, I think the NSA could certainly come up with something way moar better in a shorter timeframe, assuming they haven't already done so.
- stordoff 10y ago> The time needed for a homogeneous cluster to produce the collision would then have been of 114 K20-years, 95 K40-years or 71 K80-years If I'm reading that correctly, 852 (71 * 12) K80 cards gets that down to a month, which sounds well within the reach of NSA et al. Even getting it down to a day (71 * 12 * 30=25,560 cards) seems feasible. Assuming $10k per card ($5k launch price + doubled to account for supporting hardware), the upfront investment is around $0.25 billion, a figure that sounds plausible given, e.g., that the Utah data centre is budgeted at around $2 billion. Edit: formatting fix. Also, this is of course assuming custom hardware designed for a specific hash function isn't employed.
- jakeogh 10y agoAny serious effort I assume would use ASIC's.
- stordoff 10y agoI was interested if just using standard hardware was feasible due to the flexibility it provides (same hardware to, e.g., forge SHA-1 collisions, bruteforce other hash functions, or run speech-to-text/train ML models on a pretty much unbounded dataset), though I agree anything that is required frequently and/or quickly would probably be moved to specialised hardware.
- gcp 10y agoSay you want to replicate this in 1 month, you need 1320 GPUs for a month. They didn't specify which ones, but say at 1000 bucks per GPU, that's a 1.3M USD investment. And some pocket change for power etc. There isn't anything new about this result actually, Google just set aside the necessary resources to demonstrate it.
- zhte415 10y agoWith depreciation over a year, that falls to a USD 100k investment per attack; if realistic to depreciate over 3 years, that falls to USD 30k per replication. Not so expensive on these terms.
- aphextron 10y ago>There isn't anything new about this result actually, Google just set aside the necessary resources to demonstrate it. I think that was the point. Google wanted to show that anyone with sufficient resources could easily pull this off.
- deleted 10y ago[deleted]
- raphaelj 10y agoThey provide an estimate in their paper: > The monetary cost of computing the second block of the > attack by renting Amazon instances can be estimated from > these various data. Using a p2.16xlarge instance, > featuring 16 K80 GPUs and nominally costing > US$ 14.4 per hour would cost US$ 560 K for the > necessary 71 device years. It would be more economical > for a patient attacker to wait for low “spot prices” of > the smaller g2.8xlarge instances, which feature four K520 > GPUs, roughly equivalent to a K40 or a GTX 970. Assuming > thusly an effort of 100 device years, and a typical spot > price of US$ 0.5 per hour, the overall cost would be of > US$ 110 K.
- arenaninja 10y agoI wonder if this is really the case. Because if we can drive storage costs much closer to zero (e.g.: a beefed up local server), we can keep storing hashes and the next collision should be much closer. Starting and stopping and throwing away the previous work does work out to $560K per collision, but doesn't it just keep getting cheaper if you keep going?
- alfalfasprout 10y agoEh, at that point you may as well buy the servers yourself and let them run on-premises. Even with power, etc. that cost could easily come down 50% or more. Once you own the servers, additional tasks just cost power.
- Strom 10y agoIn addition, as any bitcoin miner knows, AMD GPUs are actually far more efficient at calculating hashes.
- empath75 10y agoProbably nothing, because they'll just used compromised aws keys to spin up instances for free.