4 ms·
> So I use ~50 character passphrases for LUKS. [...] with enough fast processors working in parallel, that could probably be cracked Let's do some napkin mat
by bostik 7y ago
> So I use ~50 character passphrases for LUKS. [...] with enough fast processors working in parallel, that could probably be cracked
Let's do some napkin math. I'm going to make a blind assumption that you are a native English speaker, which gives us entropy estimate of ~1 bit per character.[0] Let's be generous and assume your passphrase has 51 bits of entropy, which makes the following numbers nice and round.
To exhaustively search through half the passphrase space, the cracking rig will need to try 2^{50} =~ 10^{15} times. [50 * ln(2) =~ 50 * 0.301]
The default master password hashing scheme in LUKS is PBKDF2, and for modern setups, argon2. The article throws around a few hashing speed ballparks, but depending on the setup we're talking about on the order of 1000 hashing attempts per second, per core. (Yes yes, the OP has figures with the argon2 numbers at about half that - I'm being very conservative here.)
So, for a single LUKS passphrase crack we're talking, on average, of about 10^{12} core-seconds. A core-year is about 3 * 10^{7} seconds. So, with a single core the brute-force would take, on average, about 10^{5} years.
As such... in order to break one of your passphrases, an attacker would need to dedicate 10k core-years of CPU time. That's a lot of hardware and cooling, but it's certainly not infeasible. You would need to be pretty attractive/dangerous/high-value target for anyone to spend that kind of money, though.
Then the final step, threat modeling. For a normal techie, a passphrase like yours should be safe enough. For someone with access to material such as top hedge fund secrets, or into dangerous and politically juicy activities, attacking their passphrase is well within reach of a determined and well funded organisation.
0: https://people.seas.harvard.edu/~jones/cscie129/papers/stanford_info_paper/entropy_of_english_9.htm https://people.seas.harvard.edu/~jones/cscie129/papers/stanf...
- mirimir 7y agoThanks for the napkin numbers. Me, I'm just some anonymous coward who putters with privacy/anonymity stuff, and writes about it online. The funny part is that they'd arguably need to spend as much to even access those LUKS volumes. That'd be quite the joke on them.
- Thorrez 7y agoIt's ~1 bit per character for normal English text. If your password has weird stuff in it (weird words, non-grammar, weird characters) then it will be higher. Also, I'm not sure if the theoretical entropy levels are ever reached by real password crackers. I think they tend to use more basic rules. In that case I think zxcvbn might provide a better estimate (multiply guesses_log10 by 3.3 to get bits). But if your password contains a phrase that has ever been written publicly, the entropy massively decreases. https://lowe.github.io/tryzxcvbn/ https://lowe.github.io/tryzxcvbn/
- bostik 7y agoI went with ~1b per character precisely because OP stated that they use a passphrase. A long phrase with semantic meaning will be easier to remember than a 50-character diceware output, after all. Now, admittedly for me a passphrase is something that could be identified and processed by NLP-like construction. (Hence it could be also produced by one.) A sequence of random words requires, at least in my case, to come up with a special mnemonic. As a sibling post points out, if the phrase is generated by diceware (iow. sequence of words chosen at random from a large dictionary), then the entropy would be way, way higher - so high in fact that bruteforcing might be eclipsed by heat death of the universe.
- bscphil 7y agoI think that's a pretty bad underestimate of the difficulty required. The problem is that you're assuming you'd use an ordinary English sentence for a passphrase, like something you read on Twitter, not (at the very least) random words or letters. Assume you had a word list of the 10000 most common English words, and picked six of them at random. That's probably less than the 50 characters you're assuming. There are 10000^6 combinations, so 10000^6/2 guesses required. Assume you can hash 1000/s per core (IMO if your attacker can get that your hash setting are too weak)... So it's going to take 10000^6/2/1000/(3*10^7) core years to crack. If you can devote 1200 CPU cores to this project, you have a 50/50 shot at cracking the password by the time the universe is twice as old as it is now. And that's just by taking the most obvious of steps to generate a better password, which (again) is probably still less than 50 characters.
- bostik 7y agoAye, if we're talking about diceware outputs and large dictionaries, then the passphrase [very likely] has no semantic meaning. I assumed, perhaps naively, that due to use of the term passphrase we were discussing a sequence of words that might be identified, and thus also likely generated by, an NLP-like system. After all, the ~1b/chr estimate only holds true with English language texts.
- mirimir 7y agoSorry. I used "passphrase" in the sense of "long password". Not meaning that it was a sequence of words. But actually, my LUKS passphrases are sequences of letters and numbers. They're based on favorite quotations. With the standard leet letter->number replacements, and no punctuation or spaces. So they're easy to reconstruct (from my books) if I forget them.
- mirimir 7y agoDamn. I forgot to say that I just use the first letter of each word.