LastPass breach gets worse – reddit.com/r/sysadmin

Re:LastPass breach gets worse – reddit.com/r/sysadmin by tzs on Wednesday January 25, 2023 @05:35PM (#34525114)

> The TL;DR is even with 100k+ iterations of PBKDF2 an attacker can crack a password with 40 bits of entropy in about 71 days if they had access to 200 modern GPUs

...

> 50 bits of entropy changes things a bit. Now it takes 1 year instead of 71 days

I don't understand this. Going from 40 bits to 50 bits increases the size of the search space by a factor of 1024. Why does it only increase the search time by a factor of 5?

[ Parent | on HN ]

Re:LastPass breach gets worse – reddit.com/r/sysadmin by nickjj on Thursday January 26, 2023 @06:33AM (#34530441)

That's a good question to ask the podcast host (the source of those numbers).

On the reference page I linked it mentions:

> Having 40 bits of entropy is approximately 1,000 times weaker than 50 bits since bit strength scales exponentially. In other words, random bits are worth a lot because each additional truly random bit, on average, doubles the time required to crack.

71 days vs 365 days is about a 5x multiple. I'm not sure how all of that ties together.

[ Parent | on HN ]