3 ms·

From my time reverse engineering the WoW client, I can tell you Blizzard uses SRP6 [1] for authentication. You'd have to really try hard to be storing anything

by dsl 14y ago

From my time reverse engineering the WoW client, I can tell you Blizzard uses SRP6 [1] for authentication. You'd have to really try hard to be storing anything other than a hash on the backend. 1. http://srp.stanford.edu/design.html http://srp.stanford.edu/design.html

StavrosK 14y ago
Oh wow, I wasn't aware of that. So the password (or a hash of it) never leaves the client, so an eavesdropper can never get any information? That's very interesting. It looks like both parties end up with a session key, too, which is an added bonus.
- dsl 14y ago
  Pretty much. The Blizzard guys know their shit. You wouldn't go wrong replicating anything they have done security wise, which is why this breach is surprising to me.
stipes 14y ago
Down-thread [1], someone claims to have found SRP to be about 172 times slower than SHA1 on CPU due to the modular exponentiation and other overhead. Some numbers run by zaroth (down-thread) [2] show that we could see 100k 1024-bit modular exponentiations per second on a new Intel Core i7 with the cryptography extensions. A 2011 implementation paper [3] had about 20k 1024-bit RSA decryptions per second on a GTX260 using Montgomery exponentiation, so it doesn't seem like using the GPU has that much benefit for performing modular exponentiation. I haven't had time to figure out an estimated price/attempt for SRP, so it's hard to compare to the existing SHA1 figures [4]. Still, if we take the 100k/second figure for modular exponentiation (extrapolated from the number of cycles per 1024-bit modexp on a Core i7), versus the 5B/s for SHA1 on a single GPU, being 50000 times slower than the best SHA1 speeds seems pretty good to me. 1. http://news.ycombinator.com/item?id=4365079 http://news.ycombinator.com/item?id=4365079 2. http://www.opine.me/blizzards-battle-net-hack/ http://www.opine.me/blizzards-battle-net-hack/ 3. http://trone.di.fc.ul.pt/images/e/e2/ASAP11-paper.pdf http://trone.di.fc.ul.pt/images/e/e2/ASAP11-paper.pdf 4. http://golubev.com/gpuest.htm http://golubev.com/gpuest.htm

by dsl 14y ago

StavrosK 14y ago

Oh wow, I wasn't aware of that. So the password (or a hash of it) never leaves the client, so an eavesdropper can never get any information? That's very interesting. It looks like both parties end up with a session key, too, which is an added bonus.

dsl 14y ago
Pretty much. The Blizzard guys know their shit. You wouldn't go wrong replicating anything they have done security wise, which is why this breach is surprising to me.

stipes 14y ago

Down-thread [1], someone claims to have found SRP to be about 172 times slower than SHA1 on CPU due to the modular exponentiation and other overhead. Some numbers run by zaroth (down-thread) [2] show that we could see 100k 1024-bit modular exponentiations per second on a new Intel Core i7 with the cryptography extensions. A 2011 implementation paper [3] had about 20k 1024-bit RSA decryptions per second on a GTX260 using Montgomery exponentiation, so it doesn't seem like using the GPU has that much benefit for performing modular exponentiation. I haven't had time to figure out an estimated price/attempt for SRP, so it's hard to compare to the existing SHA1 figures [4]. Still, if we take the 100k/second figure for modular exponentiation (extrapolated from the number of cycles per 1024-bit modexp on a Core i7), versus the 5B/s for SHA1 on a single GPU, being 50000 times slower than the best SHA1 speeds seems pretty good to me. 1. http://news.ycombinator.com/item?id=4365079 http://news.ycombinator.com/item?id=4365079 2. http://www.opine.me/blizzards-battle-net-hack/ http://www.opine.me/blizzards-battle-net-hack/ 3. http://trone.di.fc.ul.pt/images/e/e2/ASAP11-paper.pdf http://trone.di.fc.ul.pt/images/e/e2/ASAP11-paper.pdf 4. http://golubev.com/gpuest.htm http://golubev.com/gpuest.htm