New 25 GPU Monster Devours Passwords In Seconds

Re:New 25 GPU Monster Devours Passwords In Seconds by Sam_Odio on Wednesday December 05, 2012 @02:35AM (#4875355)

It looks like - contrary to the article - the presenters are discussing hash functions, not encryption[1]. There is a difference[2].

That said, I'd be curious to know how long it'd take a device like this to decrypt "secure" AES256 text.

1. https://hashcat.net/p12/js-sha1exp_169.pdf

2. http://stackoverflow.com/a/4948393

[ Parent | on HN ]

Re:New 25 GPU Monster Devours Passwords In Seconds by _ikke_ on Wednesday December 05, 2012 @02:44AM (#4875370)

Passwords shouldn't be encrypted anyway. Chances are hackers will be able to obtain the key too, and then passwords are really easy to fetch.

Passwords should be hashed non-reversible (ideally using a slow hash). The original password is to no use of the application.

And sending plain-text passwords to users is even more bad[1].

[1]: http://plaintextoffenders.com/

[ Parent | on HN ]

Re:New 25 GPU Monster Devours Passwords In Seconds by archgoon on Wednesday December 05, 2012 @03:04AM (#4875398)

>That said, I'd be curious to know how long it'd take a device like this to decrypt "secure" AES256 text.

Well, according to the article it tops out at about 340 Gigahashes/second. Let's for the sake of simplicity assume it can do about 1 teraflop (10^12 operations per second, or about 2^40 operations per second). The best known attack for the full 14 round AES encryption reduces it's complexity to 2^96 instructions. So you finish this in 2^56 seconds, or about 2 billion years. I recommend you either wait for an advancement in cryptanalysis or just 30 more doublings of parallel processing power.

[ Parent | on HN ]