There is no need to brute force. We can build a rainbow table with valid phone numbers, which we can use to lookup a phone number hash in real time (about 50ms on a regular desktop machine). PoC available here: https://github.com/seemoo-lab/opendrop/blob/poc-phonenumber-...
Can't believe Apple doesn't understand rainbow tables.
It's not a problem of existence of rainbow table or not salted, but the problem is that hash is not very meaningful for secret on small space, like phone number (something like 10^13 even larger?).
> Sure, I'll take your statement that AirDrop hashes aren't as robust as they should be at face value, but I'm going to need you to provide more information. Of course, the PDFs have this, but the article would do well to better summarize.
Does the article they published about that which they link to not provide enough details? In that news release they referenced, they say "However, the research team shows that with new and optimized attack strategies, the low entropy of phone numbers enables attackers to deduce corresponding phone numbers from cryptographic hashes within milliseconds."
I'm not sure if I'm misunderstanding what you're asking, or if you just didn't notice that they provide the info you want fairly easily and succinctly already.
Whats _multiple_? If it takes 20 high end Tesla to crack this real-time, a desktop could feasibly brute force the hashes in hours, and a laptop could do so in a day. This is good enough for targetted attacks to be practical.
If a brute-force requires multiple 500 watt GPUs in order to brute force in real time, I'd like to know. This is vastly different than if it can be done on a laptop's GPU.
If hashes can be cracked later offline with 100% certainty, I'd like to know, since a malicious device can just collect hashes simply by traveling around a city.
But if the brute forced hashes need to be confirmed with the other AirDrop device in real time, else you don't know which of dozens, hundreds, or thousands of results you might get, then this is mostly a non-issue.