Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

stacksmashing.net

Post reply on HN
Print view View original

11–20 of 90 posts

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#11

Post by guelo »

gloob wrote: post #10
swah wrote: post #3

Earlier quoted context omitted.

"Why Not {MD5, SHA1, SHA256, SHA512, SHA-3, etc}? These are all general purpose hash functions, designed to calculate a digest of huge amounts of data in as short a time as possible." See the rest here: http://codahale.com/how-to-safely-store-a-password/

designed to calculate a digest of huge amounts of data in as short a time as possible. That's a weakness, not a strength. If you can only calculate 100 hashes per second, it will take a lot longer to crack a password than if you can calculate 100 000 hashes per second.

That's the point of that article, use bcrypt because it's slow.

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#12

Post by cperciva »

seiji wrote: post #6
umjames wrote: post #2

OK, I'll bite (and show my ignorance regarding security). What should we use in place of SHA1?

In short, for passwords, never use a hash function. Hash functions are made to be fast. If you absolutely must use a hash function, iterate it a few thousand times. Ideally, use http://www.tarsnap.com/scrypt.html (made to be computationally annoying to brute force).

made to be computationally annoying to brute force

I think the word "annoying" here wins you the understatement-of-the-day award.

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#13

Post by gloob »

guelo wrote: post #11
gloob wrote: post #10

Earlier quoted context omitted.

designed to calculate a digest of huge amounts of data in as short a time as possible. That's a weakness, not a strength. If you can only calculate 100 hashes per second, it will take a lot longer to crack a password than if you can calculate 100 000 hashes per second.

That's the point of that article, use bcrypt because it's slow.

Misinterpreted the parent post. Thanks for the correction.

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#14

Post by cperciva »

_b8r0 wrote: post #8

This is insane for password cracking. I've been trying to get Pyrit working on the Centos image but have been having trouble compiling it. An 8 node cluster with Teslas is going to bring WPA-PSK cracking down to where WEP was a few years back for those who can afford it. This is an incredibly disruptive thing for Amazon to do. They've just brought near-government grade crypto-breaking capabilities to the mass market.

They've just brought near-government grade crypto-breaking capabilities to the mass market.

No, they really haven't. Near-government grade KDF-cracking capabilities will be when Amazon announces FPGA Compute instances.

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#15

Post by dfranke »

abyssknight wrote: post #4
umjames wrote: post #2

OK, I'll bite (and show my ignorance regarding security). What should we use in place of SHA1?

SHA-2 would be a good choice. The algorithm is based on SHA-1, but avoids the same vulnerabilites found in the SHA-1 algorithm. http://en.wikipedia.org/wiki/SHA-2

SHA-1's vulnerabilities are entirely irrelevant to its unsuitability as a KDF, making SHA-2 no more suitable. As others have recommended, use scrypt or PBKDF2.

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#16

Post by daeken »

davidu wrote: post #9
umjames wrote: post #2

OK, I'll bite (and show my ignorance regarding security). What should we use in place of SHA1?

At the very least, add a random salt added to each plaintext before you run it through the SHA1. This will at least defeat rainbow attacks fairly well. That said, you need to do more and move beyond SHA1 since you can now reverse a SHA1 into plaintext with the computing power EC2 gives you.

It should be pointed out that it's impossible to "reverse a SHA1 into plaintext". The reason being that, since SHA1 produces a fixed size output and takes a variable (unbounded) input, there are an infinite number of input values for every unique output value. You may find a string that happens to come to the same SHA1, but there's no way to know whether or not it's actually what went into the SHA1 algorithm in the first place.

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#17

Post by windll »

cperciva wrote: post #14
_b8r0 wrote: post #8

This is insane for password cracking. I've been trying to get Pyrit working on the Centos image but have been having trouble compiling it. An 8 node cluster with Teslas is going to bring WPA-PSK cracking down to where WEP was a few years back for those who can afford it. This is an incredibly disruptive thing for Amazon to do. They've just brought near-government grade crypto-breaking capabilities to the mass market.

They've just brought near-government grade crypto-breaking capabilities to the mass market. No, they really haven't. Near-government grade KDF-cracking capabilities will be when Amazon announces FPGA Compute instances.

Last time I checked, GPU processing has a better-bang-for-the-buck than FPGA processing, and the gap continues to widen.

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#18

Post by samd »

daeken wrote: post #16
davidu wrote: post #9

Earlier quoted context omitted.

At the very least, add a random salt added to each plaintext before you run it through the SHA1. This will at least defeat rainbow attacks fairly well. That said, you need to do more and move beyond SHA1 since you can now reverse a SHA1 into plaintext with the computing power EC2 gives you.

It should be pointed out that it's impossible to "reverse a SHA1 into plaintext". The reason being that, since SHA1 produces a fixed size output and takes a variable (unbounded) input, there are an infinite number of input values for every unique output value. You may find a string that happens to come to the same SHA1, but there's no way to know whether or not it's actually what went into the SHA1 algorithm in the f…

But that's ok, the server doesn't know what originally went into the algorithm either.

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#19

Post by dedward »

daeken wrote: post #16
davidu wrote: post #9

Earlier quoted context omitted.

At the very least, add a random salt added to each plaintext before you run it through the SHA1. This will at least defeat rainbow attacks fairly well. That said, you need to do more and move beyond SHA1 since you can now reverse a SHA1 into plaintext with the computing power EC2 gives you.

It should be pointed out that it's impossible to "reverse a SHA1 into plaintext". The reason being that, since SHA1 produces a fixed size output and takes a variable (unbounded) input, there are an infinite number of input values for every unique output value. You may find a string that happens to come to the same SHA1, but there's no way to know whether or not it's actually what went into the SHA1 algorithm in the f…

While completely true - it's not an obstacle in a simple implementation of password hashes. Any string that produces the same hash will suffice as a password - as the password is by definition anything that hashes to that value.

Re: Cracking Passwords In The Cloud: Amazon’s New EC2 GPU Instances

#20

Post by nezza-_- »

city41 wrote: post #5

What about passwords 8 or more characters long?

You can easily calculate that using the charset and the time it took to crack a 6 character password. 6 character passwords with 95 different characters per digit take 49 minutes (Utilizing one machine and using CUDA-Multiforcer). 7 digits would mean 49*95=4655 (77 hours). But remember: The common password does not use special chars, so the actual number can be much lower.
Post reply on HN