News for hackers. Stuff that matters.

A comment on How did LastPass master passwords get compromised?. Parent comment

Re:How did LastPass master passwords get compromised? by SavantIdiot on Thursday December 30, 2021 @11:56AM (#29738359)
You are correct: if the password used to create the key is trivial, then there definitely exists hardware that can guess AES256 passwords even if a KDF is used weakly.

I'm not sure how to read that table. Is that really the cost for a 100,000 iteration PBKDF2?!?

[ Parent | on HN ]
Re:How did LastPass master passwords get compromised? by md_ on Thursday December 30, 2021 @12:24PM (#29738705)
I have not checked 1Password's math--they just come up in the results for "PBKDF2 cost of brute forcing". ;)

But yes, it matches my intuition--brute forcing human-strength keys is surprisingly cheap. (And I don't know if they're taking into account the discount if you have custom ASICs for this, defend against which is the argument made for scrypt instead.)

[ Parent | on HN ]