6 ms·

2 ^ 52 = 4,503,599,627,370,500 If that equals a number of seconds, then it is equal to 142,808,207 years. If kilometers, it is equal to 476.03 light years. So

2 ^ 52 = 4,503,599,627,370,500 If that equals a number of seconds, then it is equal to 142,808,207 years. If kilometers, it is equal to 476.03 light years. So 2 ^ 52 is still a big number anyway.

cperciva 17y ago
If that equals a number of seconds, then it is equal to 142,808,207 years. Yes, but it isn't a number of seconds. It's a number of cryptographic operations. My laptop can perform 2^23 SHA1s per second. SHA1 collision-finding is getting into the "idle resources from a university computing lab for a few months" range.
- jmatt 17y ago
  "idle resources from a university computing lab for a few months" range. Out of curiosity, what sort of time frame does that translate to for a government agency such as the NSA?
  - defen 17y ago
    They already know what you were hashing so it doesn't matter.
  - cperciva 17y ago
    Out of curiosity, what sort of time frame does that translate to for a government agency such as the NSA? Less than zero seconds. I'm sure the NSA computed collisions in SHA1 at least two years ago -- they had more than enough resources and they'd have to be idiots to not be interested in investigating the problem.
  - durin42 17y ago
    ISTR that the "rule of thumb" is that the NSA is a couple of years ahead of the mainstream for both Mathematics and computer tech. I don't know how valid that is, but it probably is a decent baseline for paranoia.
    - eru 17y ago
      Interesting. How do these estimates square with the perceived advantages of open source development over closed source in the realm of software? The NSA has more money, but so do many commercial software companies. Does the NSA have other advantages? Is cryptography so different from software? Or does the NSA just fool people about their level of sophistication but relies on Rubber-hose cryptanalysis and eaves-dropping on telephone calls to get their result?
    - cperciva 17y ago
      ISTR that the "rule of thumb" is that the NSA is a couple of years ahead of the mainstream for both Mathematics and computer tech. For cryptographic research, that's probably true. For "computer technology" in general, probably not -- they have a large budget, but not so large that it would make sense for them to independently replicate all of the work companies like Intel and IBM do on lithographic processes. I'm sure the NSA has access to fabrication capacity, though -- almost certainly via deals with US companies to allow them to run a few wafers here and there.
- dfranke 17y ago
  For the Storm botnet it'd be on the order of one hour.
Eliezer 17y ago
And if you do a billion operations per second, it's equal to .142808207 years.

2 ^ 52 = 4,503,599,627,370,500 If that equals a number of seconds, then it is equal to 142,808,207 years. If kilometers, it is equal to 476.03 light years. So 2 ^ 52 is still a big number anyway.

cperciva 17y ago

If that equals a number of seconds, then it is equal to 142,808,207 years. Yes, but it isn't a number of seconds. It's a number of cryptographic operations. My laptop can perform 2^23 SHA1s per second. SHA1 collision-finding is getting into the "idle resources from a university computing lab for a few months" range.

jmatt 17y ago
"idle resources from a university computing lab for a few months" range. Out of curiosity, what sort of time frame does that translate to for a government agency such as the NSA?
- defen 17y ago
  They already know what you were hashing so it doesn't matter.
- cperciva 17y ago
  Out of curiosity, what sort of time frame does that translate to for a government agency such as the NSA? Less than zero seconds. I'm sure the NSA computed collisions in SHA1 at least two years ago -- they had more than enough resources and they'd have to be idiots to not be interested in investigating the problem.
- durin42 17y ago
  ISTR that the "rule of thumb" is that the NSA is a couple of years ahead of the mainstream for both Mathematics and computer tech. I don't know how valid that is, but it probably is a decent baseline for paranoia.
  - eru 17y ago
    Interesting. How do these estimates square with the perceived advantages of open source development over closed source in the realm of software? The NSA has more money, but so do many commercial software companies. Does the NSA have other advantages? Is cryptography so different from software? Or does the NSA just fool people about their level of sophistication but relies on Rubber-hose cryptanalysis and eaves-dropping on telephone calls to get their result?
  - cperciva 17y ago
    ISTR that the "rule of thumb" is that the NSA is a couple of years ahead of the mainstream for both Mathematics and computer tech. For cryptographic research, that's probably true. For "computer technology" in general, probably not -- they have a large budget, but not so large that it would make sense for them to independently replicate all of the work companies like Intel and IBM do on lithographic processes. I'm sure the NSA has access to fabrication capacity, though -- almost certainly via deals with US companies to allow them to run a few wafers here and there.
dfranke 17y ago
For the Storm botnet it'd be on the order of one hour.

Eliezer 17y ago

And if you do a billion operations per second, it's equal to .142808207 years.