Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WTF is a KDF?

blog.dataparty.xyz

Post reply on HN
Print view View original

61–70 of 98 posts

Re: WTF is a KDF?

#61

Post by zokier »

doodlesdev wrote: post #23
TacticalCoder wrote: post #15

What I find weird is that not many talk about one of the parameter to PBKDF2, c , the number of iterations desired. Someone here mentioned it a few days ago: just make decryption fast enough to be acceptable for you but still a big multiplier compared to the default. What do people care, when unlocking their SSD, if it takes 3ms or 300ms to unlock the SSD at boot? I mean: attacker shall have a bazillion RAM and a tri…

The problem is PBKDF2 isn't as memory intensive, it's really easy to parallelize on a modern GPU thus making it a much worse PBKDF than Argon2id. Increasing iteration count is just a bandaid over this problem, you also need to have control over memory usage.

Sure argon2 is better, but high iteration count pbkdf2 is still a lot of work to crack, and afaik the work still scales linearly with iteration count.

Lets do bit of reality check here. I checked my 14 year old laptop luks setup and it has iteration count set to 462093 and it unlocks near instantly. Looking at hashcat benchmark results for PBKDF2-HMAC-SHA1[1] I'd estimate that for that iteration count it'd do about 47 kH/s. Running a full year with 100000 gpus of that perf means about 2^47 hashes bruteforced (=log2(47e3×100e3×86400×365)).

Considering that I'm using maybe 70ish bit secret there, I'm not exactly concerned. I still should upgrade to have better margin, but there is no reason to panic; I'd consider it still practically uncrackable with current level of tech.

[1] https://gist.github.com/Chick3nman/32e662a5bb63bc4f51b847bb4...

Re: WTF is a KDF?

#62

Post by kazinator »

> Earlier this week a letter from an activist imprisoned in France was posted to the Internet.

And this letter's authenticity was verified how?

Even if authentic, it could be the result of coercion, to create a bluff and spook some other activists.

Or it could be that the cops fooled the activist into believing that they cracked his hard drive, so that he then wrote the letter.

Do not believe everything "posted to the Internet".

The letter says (DeepL translation) that "There are even files that had been deleted and emails that had been downloaded with Thunderbird (and then deleted)."

Files and e-mails come from somewhere. If I know that you downloaded certain files or e-mails from a mail server to your encrypted hard drive, I could claim that I decrypted them from your drive and spook you.

Re: WTF is a KDF?

#63

Post by marginalia_nu »

le-mark wrote: post #55
marginalia_nu wrote: post #27

Earlier quoted context omitted.

If I wanted to get at an encrypted hard drive, I'd just tamper with the keyboard and record the password as it was being typed. Hardware keyloggers can be made very tiny with resources and determination.

Does anyone have information or experience with this?

The USB HID protocol isn't encrypted. You can literally just add a pass through that logs (or transmits) the data.

You'd have to check your USB connectors for a small extra dongle every time you boot up with just what is consumer-available[1]. There's also this type of stuff that can be wired into a keyboard[2], obviously harder to detect but a bit more involved to install as well.

With a national R&D budget you can without a doubt do much better than both of these.

[1] https://www.keelog.com/airdrive-keylogger/

[2] https://www.keydemon.com/en/keydemon/28-1576-hardware-keylog...

Re: WTF is a KDF?

#64

Post by septune »

alsobrsp wrote: post #60
mr_mitm wrote: post #13

It really annoys me how everyone takes that statement that a 20 character password has been cracked at face value. If it was randomly generated, it is physically impossible to crack even if it was hashed with MD5. It's also unlikely that somebody memorized 20 random characters. It is much more likely that the passphrase was weak because it's the title of a Wikipedia article or contained in some public word list. Also…

> It's also unlikely that somebody memorized 20 random characters. I routinely memorized 15 character random passwords until I switched to bitwarden, 20 doesn't seem out of bounds. Now, with bitwarden, I have no idea what any of my passwords are.

I did this too, now i generate a random pwd long as hell and i do a pwd recovery when i have to log-in so i don’t have to store them anywhere. My master pwd is my email pwd based on a mail server i operate. Yes paranoid is my second name.

Re: WTF is a KDF?

#65

Post by terom »

TacticalCoder wrote: post #15

What I find weird is that not many talk about one of the parameter to PBKDF2, c , the number of iterations desired. Someone here mentioned it a few days ago: just make decryption fast enough to be acceptable for you but still a big multiplier compared to the default. What do people care, when unlocking their SSD, if it takes 3ms or 300ms to unlock the SSD at boot? I mean: attacker shall have a bazillion RAM and a tri…

Yes, `cryptsetup luksFormat` selects the LUKS1 key slot pbkdf iteration count parameter at runtime by benchmarking against a target `--iter-time` [1] [2], which is either 1s or 2s depending on version [3].

For a LUKS1 image created with Ubuntu 18.04 on a i5-8265U (Q3'18) CPU, that seems to result in an iteration count on the order of 1.8M. Assuming the RTX 4090 hashcat benchmarks [4] scale linearly on the iteration count, that's about 10kH/s for PBKDF2-HMAC-SHA1 or 5kH/s for PBKDF2-HMAC-SHA256.

In terms of brute-force vs password entropy, that would give you roughly 45 bits of entropy for 1k gpu-months, or ~250k gpu-years to net 56 bits of entropy. Those would be on the order of [a-z0-9]{8} (41 bits), [a-zA-Z0-9]{8} (47 bits) or [a-z]{12} (56 bits).

Worryingly close enough to make replacing the KDF a relevant concern, but still enough to make this story about brute-forcing a random 20-character password somewhat implausible, unless the password was far weaker than implied.

[1] https://man7.org/linux/man-pages/man8/cryptsetup-luksformat.... [2] https://wiki.archlinux.org/title/dm-crypt/Device_encryption#... [3] https://mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v... [4] https://gist.github.com/Chick3nman/32e662a5bb63bc4f51b847bb4...

Re: WTF is a KDF?

#66

Post by vladvasiliu »

jeroenhd wrote: post #46
dist-epoch wrote: post #12

Compared to Windows+Bitlocker, using full disk encryption on Ubuntu (the most user friendly distro) is bizarrely difficult. By default the boot partition is not encrypted (so evil maid attacks are easier) and the KDF iteration counts are way too low, as can be seen here. When I setup FDE with LUKS on my Ubuntu laptop I had to go the manual route since I noticed that the default iteration counts don't make any sense,…

TL;DR: secure boot is hard, TPM security is a challenge. FDE works fine with encrypted boot, it's just not the default for Ubuntu. I just ticked the "encrypt my install" box as far as I know, I only found out that my /boot wasn't encrypted after the fact. For evil maid attacks, encrypting /boot or not shouldn't really matter unless there's a known exploit for your bootloader. IMO it doesn't matter much because before…

> Microsoft can get around this problem because their root keys are preloaded into almost every secure boot capable device you can find. They can pre-sign a bootloader and distribute it to hundreds of millions of computers, whereas every Linux distro has to jump through hoops and use the Microsoft-signed loader as an inbetween stage or have the user set up their own keys and signature system.

But then, they can also (technically) sign a bogus bootloader if asked nice-enough, like by a state agency.

> On Linux, there is a wide variety of tools, but as far as I can tell, you can only choose between "unlock the disk from the TPM" or "unlock the disk with your passphrase".

You can also have TPM + PIN since a few versions of systemd ago. I have set this up on my work laptop and seems to work well enough.

Re: WTF is a KDF?

#67

Post by Beldin »

rhplus wrote: post #39
mr_mitm wrote: post #13

It really annoys me how everyone takes that statement that a 20 character password has been cracked at face value. If it was randomly generated, it is physically impossible to crack even if it was hashed with MD5. It's also unlikely that somebody memorized 20 random characters. It is much more likely that the passphrase was weak because it's the title of a Wikipedia article or contained in some public word list. Also…

He says his BitLocker drive was on a work computer. If it was managed through Active Directory then those key may have been recoverable through his employer. https://learn.microsoft.com/en-us/windows/security/informati...

There used to be a bug where bitlocker would rely on the firmware's encryption functionality if it was there, and there were cases of firmware with a literal "if checkpasswd () then"... overwrite that check to true and you're in.

Soif it concerned a disk with that vulnerability, maybe they did it like that.

(See https://www.ieee-security.org/TC/SP2019/papers/310.pdf)

Re: WTF is a KDF?

#68

Post by dmix »

kazinator wrote: post #62

> Earlier this week a letter from an activist imprisoned in France was posted to the Internet. And this letter's authenticity was verified how? Even if authentic, it could be the result of coercion, to create a bluff and spook some other activists. Or it could be that the cops fooled the activist into believing that they cracked his hard drive, so that he then wrote the letter. Do not believe everything "posted to th…

This sounds a bit paranoid. You give the police too much credit. Lying to the public to scare off people from using Linux encryption?

Re: WTF is a KDF?

#69

Post by aquariusDue »

Closi wrote: post #52
flangola7 wrote: post #50

Earlier quoted context omitted.

Those aren't mutually exclusive. France isn't known for having neutered nonviolent protests like those in the US and UK.

It's true, but if a murderer that donated to charity was imprisoned I would probably go with "a murderer imprisoned in France" rather than "a philanthropist imprisoned in France".

How about a "murderous philanthropist"?

Re: WTF is a KDF?

#70

Post by eternalban »

mr_mitm wrote: post #13

It really annoys me how everyone takes that statement that a 20 character password has been cracked at face value. If it was randomly generated, it is physically impossible to crack even if it was hashed with MD5. It's also unlikely that somebody memorized 20 random characters. It is much more likely that the passphrase was weak because it's the title of a Wikipedia article or contained in some public word list. Also…

> even if it was hashed with MD5

This is what I don't understand about articles like this. Say we're using a cryptographic hash to generate the password from even a commonplace phrase. Typically you will have thousands of random bits in the hash and you can grab a uint64 (or even a uint128 if you want) from anywhere in that (theoretically uniformly distributed) set of bits. Is that not a random point in a 2^64 (2^128) space?

Post reply on HN