3 ms·

You're right, but don't forget Deep Crack. (FPGA-)hardware-based attacks have only become cheaper since then; I would be surprised if the NSA doesn't have a few

You're right, but don't forget Deep Crack. (FPGA-)hardware-based attacks have only become cheaper since then; I would be surprised if the NSA doesn't have a few arrays. (Also, 80 bits is usually enough to withstand attack, no?)

marshray 15y ago
Yep. There are off-the-shelf FPGA arrays available. Still, bad guys would probably find it much cheaper to rent botnet time for a $0.02/(host*day) or whatever the going rate is. A solid 80 bits of security out of any of these functions might turn out to be safe forever. But, in practice, most password databases are going to have some fraction of users choosing passwords straight out of the cracker's dictionary, some fraction that will never ever be cracked, and the smallest fraction being crackable according to the defender's choice of work factor.
- JoachimSchipper 15y ago
  COPACOBANA cost ~$10 000 and apparently is as fast as 2500 PCs for the DES cracking it's optimized for, so ~$4/PC-work-unit plus insignificant power costs. You'd need to find someone with experience with implementing crypto in hardware, though. On the other hand, botnets risk detection. (If you're buying in bulk, ASICs are cheaper, but few will be willing to pay for that much cracking power.)
  - marshray 15y ago
    Yeah, I suspect it depends on your bad guys (er, sorry, "threat model") whether or not they feel more comfortable trying to buy botnet time or acquire $10,000 worth of FPGAs in an untraceable way. If I were a bad guy, I would prefer to not have a password-cracking special-purpose supercomputer in my possession. (But I'm not a bad guy, and in fact I would love to have a few around the house. :-)
  - mukyu 15y ago
    http://events.ccc.de/congress/2010/Fahrplan/events/4203.en.html http://events.ccc.de/congress/2010/Fahrplan/events/4203.en.h... precis: exhaustive search on DES for $1000 in FPGAs from eBay, 2 years ago DES is in the range of 'costs less than a new phone/iPad' to do an exhaustive search at this point

marshray 15y ago

Yep. There are off-the-shelf FPGA arrays available. Still, bad guys would probably find it much cheaper to rent botnet time for a $0.02/(host*day) or whatever the going rate is. A solid 80 bits of security out of any of these functions might turn out to be safe forever. But, in practice, most password databases are going to have some fraction of users choosing passwords straight out of the cracker's dictionary, some fraction that will never ever be cracked, and the smallest fraction being crackable according to the defender's choice of work factor.

JoachimSchipper 15y ago
COPACOBANA cost ~$10 000 and apparently is as fast as 2500 PCs for the DES cracking it's optimized for, so ~$4/PC-work-unit plus insignificant power costs. You'd need to find someone with experience with implementing crypto in hardware, though. On the other hand, botnets risk detection. (If you're buying in bulk, ASICs are cheaper, but few will be willing to pay for that much cracking power.)
- marshray 15y ago
  Yeah, I suspect it depends on your bad guys (er, sorry, "threat model") whether or not they feel more comfortable trying to buy botnet time or acquire $10,000 worth of FPGAs in an untraceable way. If I were a bad guy, I would prefer to not have a password-cracking special-purpose supercomputer in my possession. (But I'm not a bad guy, and in fact I would love to have a few around the house. :-)
- mukyu 15y ago
  http://events.ccc.de/congress/2010/Fahrplan/events/4203.en.html http://events.ccc.de/congress/2010/Fahrplan/events/4203.en.h... precis: exhaustive search on DES for $1000 in FPGAs from eBay, 2 years ago DES is in the range of 'costs less than a new phone/iPad' to do an exhaustive search at this point