7 ms·
The World’s Fastest DES Cracker
- fortran77 6y agoI'm surprised that from 1998 to 2020 they only got ~ 10x improvement in speed.
- StavrosK 6y agoPer dollar? Or per watt?
- abiogenesis 6y agoIt's only 25x per dollar (initial investment; not running costs): > In 1998 the Electronic Frontier Foundation built the EFF DES Cracker. It cost around $250,000 > The system that you're renting time on is over $100k in specialized FPGA hardware
- Palomides 6y agogoing from ~2000 ASICs to ~50 FPGAs and still being much faster is pretty good imo
- abiogenesis 6y agoTrue, but the cost hasn't changed by the same magnitude: > In 1998 the Electronic Frontier Foundation built the EFF DES Cracker. It cost around $250,000 > The system that you're renting time on is over $100k in specialized FPGA hardware
- ARandomerDude 6y ago$250K in 1998 is $400K today, if the inflation calculator I found on Google is correct. So there's a 4X decrease in inflation adjusted cost. Not an order of magnitude, but it's something.
- hedgehog 6y agoThose are also older FPGAs, price for the same performance today would be lower.
- tyingq 6y agoThe Deep Crack ASICs had 25 processing units per chip, so 44,544 "cores" total for the EFF DES cracker. The crack.sh FPGA setup has 1920 "cores" (48 boards, 40 "cores" per board). So it's 10x faster with 23x fewer cores.
- wmf 6y agoYou lose ~10x going from ASIC to FPGA but FPGAs probably got 100x better which nets only 10x overall improvement.
- femto113 6y agoEspecially when you consider a state of the art processor in 1998 was doing < 1,000 MIPS and state of the art processor now can do > 1,000,000.
- xref 6y agoIf this can exhaust the DES keyspace in 26hrs, what’s the time to exhaust triple-DES?
- LeoPanthera 6y ago2̵6̵^̵3̵ ̵=̵ ̵1̵7̵,̵5̵7̵6̵ ̵h̵o̵u̵r̵s̵ ̵=̵ ̵2̵ ̵y̵e̵a̵r̵s̵ I am wrong.
- segfaultbuserr 6y agoIt's a great underestimation. Breaking 3DES is not 3 times more complex than DES, but 2^56 times more complex. 26 x 2^56 = 1873497444986126336 hours. It's why we still trust 128-bit encryption when the total computing power of humanity already exceeded 2^80 operations per seconds. It's frustrating that I has to refute the argument many times: "If 80-bit is insecure today, 128-bit will be insecure soon any cryptosystem can only guarantee a few decades of security because Moore's Law..." No, it's not how it works (although quantum computers will make 128-bit insecure, but the solution is already available today: 256-bit). The human brain is not wired to understand exponential growth.
- chmod775 6y ago>It's frustrating that I has to refute the argument many times: "If 80-bit is insecure today, 128-bit will be insecure soon any cryptosystem can only guarantee a few decades of security because Moore's Law..." I believe you are doing the people you are talking about an injustice here, because assuming Moore's Law held, we would be doubling computing power every two years (well, transistors really). Doubling... what comes to mind... Ah yes! Bits! Because with every bit you are doubling the number of keys, meaning that you could crack an 81 bit key today in the same it would have taken you to crack an 80 bit key two years ago. So that gives you 100 years, or about 10 decades, to go from 80 bit to 128 bits. Or, in other words, Moore's law is also about exponential growth. So if those people you quoted did indeed say "a few decades" they were right on.
- 6y ago
- freefal 6y agoBack in '07, my school still used a custom email protocol called Blitzmail that verified the user by sending a random number, having the user encrypt the random number via DES using his password as the key and then send the result back. One problem (there were many) was that passwords were 8 characters and DES only wanted a 56-bit key so the protocol just dropped the least significant bit of each character. So while everyone thought they had one password, they really had 2^8 = 256 passwords, where 'b' and 'c' were interchangeable as were 'd' and 'e' and so on... Now that was easy to crack.
- TwoBit 6y agoSurely they meant to drop the high bit instead of the low bit... ?
- deleted 6y ago[deleted]
- dogma1138 6y agoDartmouth, I remember a talk about it not related to security it was one of the most late 80’s early 90’s “internet revolution” things I’ve seen in my life.
- freefal 6y agoIndeed. It was actually a great system that sat somewhere between email and IM in its usage on campus. The Windows and Mac clients had notifier processes that would signal the client to poll if the server alerted them to new messages. It made messages appear nearly instantly which they did not back in the POP/IMAP time-based polling days.
- droopyEyelids 6y agoThere must have been something like this going on with the BIOS password of my father's 386 when I was growing up. He password protected it so we could only play for controlled periods of time, and chose "tricycle" as the password, but my sister and I guessed "bicycle" in the hours of typing every word we knew into the prompt. "bicycle" worked!
- tait 6y agoir-Relevant XKCD: https://xkcd.com/538/ https://xkcd.com/538/
- tasty_freeze 6y ago> Today, with the advent of Field Programmable Gate Arrays (FPGAs) Xilinx was founded in 1984, so the advent of FPGAs is at least that old. The linked page estimates the price to crack a key via a CPU farm is $125K, and cracking one via a GPU farm is $20K. But they don't say what it costs via their system. The FAQ answers the question, "Why are you charging so much for this", but again, without referencing that price. I don't feel like submitting a credit card and generating a token to find out.
- wmf 6y agoIt's $20-$100.
- marcolussetti 6y agoThere is a price list on the website: https://crack.sh/get-cracking/ https://crack.sh/get-cracking/ Toward the end of the page. Looks like $20 except for rush orders (for most types)
- tasty_freeze 6y agoThanks! I visited the page but the table is off the bottom of my screen and I didn't think to scroll. I immediately saw the "submit a job" form and got put off. All the same, it would be better to also state their range of prices on the page where they estimate CPU and GPU-based cracking costs.
- schoen 6y agoI'm sad to think that it's probably not the world's fastest DES cracker. The owners of the world's fastest DES cracker have probably neglected to write a public web site about it. :-(
- 29athrowaway 6y agoIs anyone still using DES or Triple DES?
- dogma1138 6y agoPlenty of legacy systems still do, also it might be useful to recover historic data or credentials.
- dragontamer 6y agoHmmm... The paper "A Fast New DES Implementation in Software" calculated 64-parallel DES Round across a 64-bit register in 1,040 DEC Alpha instructions. There are 16 rounds per DES, and then another 2,500 clock ticks to convert the bitwise representation back into normal form. The key to understanding things: > The full circuit of DES contains about 16000 gates (including the key scheduling, which costs nothing), and thus we can compute DES 64 times in about 16000 instructions on 64-bit processors. Each logic-gate can be seen as an AND/OR/XOR instruction on a 1-bit computer. Use 64-bit wide AND/OR/XOR to do 64x calculations in parallel. The modern equivalent would be 256x in parallel (AVX2 for Threadripper), AVX512 for Skylake-X, and 1024x in parallel for NVidia Ampere. I dunno what kind of post-processing would need to be done, so I'll estimate an even 20,000 clock ticks per 64x DES result on the old DEC Alpha. A modern GPU can probably execute 1024-bit per clock tick (AMD RDNA / NVidia Ampere 32-way x 32-bit), while a modern AVX512 CPU can execute 512-bit at a time. And AVX2 is 256-bit at a time (but probably faster: AVX2 / AVX512 execute XOR / ADDs at a rate of MORE than one clock tick per clock cycle). The paper was very innovative: the SBox was a 100-instruction long sequence of AND / OR / XOR instructions. Avoiding the cache probably is a good thing, but I do wonder if there's a way to benefit from memory somehow. * ~80 AVX2 clock ticks per result (20k clock ticks / 256-bits) * ~40 AVX512 clock ticks per result (20k clocks / 512 bits) * ~20 GPU clock ticks per result (20k clocks / 1024 bits) So a 64-core AMD at 4GHz probably could do ~3.2-billion DES attempts per second. A 216 SM NVidia A100 at 1.4 GHz probably can do ~15-billion DES attempts per second. --------------- Hmmmmmm.... the results this page claims is ~16-billion DES attempts per second. Which does seem to be approximately what I'd expect a concerted effort on an NVidia A100 would get. I'm doing very "napkin-level" math here with tons of assumptions. The SBox-lookup (100-AND/OR/XOR gates) might be better run on AVX / AVX512 however, because AMD Threadripper can do 4x simple AND/OR/XOR instructions per clock tick, and IIRC Intel AVX512 can do 3x simple bitwise instructions per clock tick. With the proper "cut dependencies", an SBox probably can be really executed in under 40 clock ticks instead of 100. CPUs could very well cut out hundreds of cycles from the above estimate. The S-Box is very curious for DES: it is a non-reversible 6-bit lookup with a 4-bit result.
- lmilcin 6y agoYears ago I worked on my own HSM which used FPGA to implement DES. It had 3 copies of DES IP which allowed streaming 3DES. I could have put more copies of this on the FPGA but the single triplet was enough to stream data through it at astronomical speed. I think it was enough to saturate 1Gb/s and so I did not need more. Compared to this, AES was much more difficult and it did not fit the FPGA I had and I eventually gave up.