3 ms·

> By renting a GPU cluster online, the entire chosen-prefix collision attack on SHA-1 costed us about 75k USD. So they just decided to try their attack and spe

> By renting a GPU cluster online, the entire chosen-prefix collision attack on SHA-1 costed us about 75k USD. So they just decided to try their attack and spend two years worth of salary on it?? That's crazy.

oppositelock 7y ago
That's dirt cheap for a government actor, and we can be sure that the big governments have been doing this sort of attack for years.
- rustybolt 7y ago
  It's a lot of money for an academic researcher.
  - progval 7y ago
    Researchers in applied fields other than CS spend this kind of money on a regular basis. eg. https://www.quora.com/What-are-the-costs-for-lab-rat-testing-in-the-US https://www.quora.com/What-are-the-costs-for-lab-rat-testing...
  - CydeWeys 7y ago
    Is it? Multi-million grants are common in academia. A lot of research is expensive. When I worked in a lab the materials alone for a single day's experiment would frequently run into the thousands. E.g. the total human RNA samples we used cost many thousands of dollars per milligram. Admittedly this is a different field, but it's still academia.
    - klmr 7y ago
      > Multi-million grants are common in academia. Not in the way you explain. Multi-million dollar grants are usually awarded over multiple years, and pay for multiple researchers’ salaries, as well as other resources, some of which are expected to outlast the project (e.g. microscopes, or hardware for databases). Burning 75k on a single experiment (which is effectively what was done here) is rare. Note that this is true even for current hot topics such as biomedical (e.g. cancer) research, for which vast chunks of the federal budget have been allocated in multiple countries. Obtaining similar sums in less sexy fields is much harder. And even in biomedical research, multi-million dollar grants are considered large. Most grants are much smaller, they just don’t get talked about as much. Since you mention human RNA samples I assume you know this. You mention the per-milligram cost but this is pretty misleading if you mean to imply that “milligram” is somehow little, because it isn’t: yes, the samples are tiny (≤1 µg of RNA is more typical than milligrams!), but so what? It’s not like we need more.
exikyut 7y ago
No. It's incredibly generous and selfless. They threw that money away just to incontrovertibly prove a huge point to the entire security community (and all developers, at the end of the day). Like... chaotic good. Really really good.
martpie 7y ago
You can see their emails at the bottom: those are universities/research institutes domains. You can be sure _they_ did not actually spend that themselves.
- rustybolt 7y ago
  I'm just amazed that they were willing to take the risk that there was a bug in the code and they wouldn't find a collision.
  - basilgohar 7y ago
    It was a sound premise to investigate. EFF spent much more to demonstrate the weakness of DES decades ago, and it highlighted the need for stronger crypto and the fact that nation states would be more than able to break commonly-used crypto at the time.
  - CiPHPerCoder 7y ago
    This is cheap! Breaking MD5 for the Flame malware probably set the NSA back millions when you sum the person-hours and CPU time together.
n-gauge 7y ago
As GPU's get better the cost will come down. Was it a massive cluster of RTX2060's or something?
- aidenn0 7y ago
  900 GTX-1060s.

oppositelock 7y ago

That's dirt cheap for a government actor, and we can be sure that the big governments have been doing this sort of attack for years.

rustybolt 7y ago
It's a lot of money for an academic researcher.
- progval 7y ago
  Researchers in applied fields other than CS spend this kind of money on a regular basis. eg. https://www.quora.com/What-are-the-costs-for-lab-rat-testing-in-the-US https://www.quora.com/What-are-the-costs-for-lab-rat-testing...
- CydeWeys 7y ago
  Is it? Multi-million grants are common in academia. A lot of research is expensive. When I worked in a lab the materials alone for a single day's experiment would frequently run into the thousands. E.g. the total human RNA samples we used cost many thousands of dollars per milligram. Admittedly this is a different field, but it's still academia.
  - klmr 7y ago
    > Multi-million grants are common in academia. Not in the way you explain. Multi-million dollar grants are usually awarded over multiple years, and pay for multiple researchers’ salaries, as well as other resources, some of which are expected to outlast the project (e.g. microscopes, or hardware for databases). Burning 75k on a single experiment (which is effectively what was done here) is rare. Note that this is true even for current hot topics such as biomedical (e.g. cancer) research, for which vast chunks of the federal budget have been allocated in multiple countries. Obtaining similar sums in less sexy fields is much harder. And even in biomedical research, multi-million dollar grants are considered large. Most grants are much smaller, they just don’t get talked about as much. Since you mention human RNA samples I assume you know this. You mention the per-milligram cost but this is pretty misleading if you mean to imply that “milligram” is somehow little, because it isn’t: yes, the samples are tiny (≤1 µg of RNA is more typical than milligrams!), but so what? It’s not like we need more.

exikyut 7y ago

No. It's incredibly generous and selfless. They threw that money away just to incontrovertibly prove a huge point to the entire security community (and all developers, at the end of the day). Like... chaotic good. Really really good.

martpie 7y ago

You can see their emails at the bottom: those are universities/research institutes domains. You can be sure _they_ did not actually spend that themselves.

rustybolt 7y ago
I'm just amazed that they were willing to take the risk that there was a bug in the code and they wouldn't find a collision.
- basilgohar 7y ago
  It was a sound premise to investigate. EFF spent much more to demonstrate the weakness of DES decades ago, and it highlighted the need for stronger crypto and the fact that nation states would be more than able to break commonly-used crypto at the time.
- CiPHPerCoder 7y ago
  This is cheap! Breaking MD5 for the Flame malware probably set the NSA back millions when you sum the person-hours and CPU time together.

n-gauge 7y ago

As GPU's get better the cost will come down. Was it a massive cluster of RTX2060's or something?

aidenn0 7y ago
900 GTX-1060s.