Re:I mean, why not tell everyone our password hashes?
by Retric on Saturday July 15, 2017 @08:37AM
(#14776372)
Not at the same hash rate. Sure you can do binary search, but 100^14 or even 30^14 such searches is not fast. So, it's about as fast if you want 2 passwords but not 2 billion passwords.
[ Parent
| on HN ]
Re:I mean, why not tell everyone our password hashes?
by TheCoelacanth on Saturday July 15, 2017 @02:01PM
(#14777982)
It wouldn't be a binary search, the values are already hashes, so you could do a hash table lookup very cheaply. MD5 isn't great by cryptological standards, but it is extremely robust by hash table standards.
While no extra resources might not have been strictly accurate, the lookup would be practically free compared to the time it takes to compute the hash.
Re:I mean, why not tell everyone our password hashes?
by Retric on Saturday July 15, 2017 @04:11PM
(#14778688)
In the example I gave the hashes don't fit on GPU's and for your hash table lookup you would need ~64GB of ram to do the hash table lookups. You can scale this across multiple machines but even the ideal case of 2 lookups to main memory * 100^14 is slow and thus expensive.