Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances
stacksmashing.net
Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances
1–10 of 90 posts
Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances
#2OK, I'll bite (and show my ignorance regarding security). What should we use in place of SHA1?
Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances
#3OK, I'll bite (and show my ignorance regarding security). What should we use in place of SHA1?
"Why Not {MD5, SHA1, SHA256, SHA512, SHA-3, etc}?
These are all general purpose hash functions, designed to calculate a digest of huge amounts of data in as short a time as possible."
See the rest here: http://codahale.com/how-to-safely-store-a-password/
Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances
#4OK, I'll bite (and show my ignorance regarding security). What should we use in place of SHA1?
SHA-2 would be a good choice. The algorithm is based on SHA-1, but avoids the same vulnerabilites found in the SHA-1 algorithm.
Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances
#5What about passwords 8 or more characters long?
Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances
#6OK, I'll bite (and show my ignorance regarding security). What should we use in place of SHA1?
In short, for passwords, never use a hash function. Hash functions are made to be fast. If you absolutely must use a hash function, iterate it a few thousand times.
Ideally, use http://www.tarsnap.com/scrypt.html (made to be computationally annoying to brute force).
Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances
#7First of all, only the initial release day, and the EC2 GPU killer app has been discovered.
Second, store passwords as a salted hmac, not just a shaXsum. It is still usually a singel command, and WAY more secure than simple shaX or mdX, as it eliminates the risk of prefix/postfix attacks. Adding the salt makes dictionaries pretty irrelevant (as long as each install has a unique salt).
I mean GEEZ; even php does it now: http://us2.php.net/manual/en/function.hash-hmac.php
Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances
#8This is insane for password cracking. I've been trying to get Pyrit working on the Centos image but have been having trouble compiling it. An 8 node cluster with Teslas is going to bring WPA-PSK cracking down to where WEP was a few years back for those who can afford it.
This is an incredibly disruptive thing for Amazon to do. They've just brought near-government grade crypto-breaking capabilities to the mass market.
Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances
#9OK, I'll bite (and show my ignorance regarding security). What should we use in place of SHA1?
At the very least, add a random salt added to each plaintext before you run it through the SHA1. This will at least defeat rainbow attacks fairly well.
That said, you need to do more and move beyond SHA1 since you can now reverse a SHA1 into plaintext with the computing power EC2 gives you.
Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances
#10OK, I'll bite (and show my ignorance regarding security). What should we use in place of SHA1?
"Why Not {MD5, SHA1, SHA256, SHA512, SHA-3, etc}? These are all general purpose hash functions, designed to calculate a digest of huge amounts of data in as short a time as possible." See the rest here: http://codahale.com/how-to-safely-store-a-password/
designed to calculate a digest of huge amounts of data in as short a time as possible.
That's a weakness, not a strength. If you can only calculate 100 hashes per second, it will take a lot longer to crack a password than if you can calculate 100 000 hashes per second.