Re:1Password GPU brute-force with 3M hash/s
by quinndupont on Tuesday April 16, 2013 @09:20PM
(#5562014)
Thanks for all the responses everyone! But, isn't the point of BKDF2-HMAC-SHA1 in 1Password that it's a 320 bit key, that he reduced down to only 160 bits? Unless I'm totally missing something here, it doesn't much matter if the password you are attacking is 6, or 7, or 8 or 50 characters long, you'll still need to attack all 160 bits, right? (Ignoring rainbow tables, or hashing on password dictionaries, etc., in other words, just brute force cracking). Am I being stupid?
Re:1Password GPU brute-force with 3M hash/s
by Scaevolus on Tuesday April 16, 2013 @08:00PM
(#5561719)
PBKDF2 is salted, you can't attack multiple hashes with one computation.
Re:1Password GPU brute-force with 3M hash/s
by michaelt on Tuesday April 16, 2013 @08:13PM
(#5561764)
Yes, to attack multiple files you'd have to do multiple computations.
However, if you can try all dictionary words in 0.5 seconds, you can try that against 172800 files in a day.
Of course you'd need a security breach that gave you access to multiple files too!
Re:1Password GPU brute-force with 3M hash/s
by danielhunt on Wednesday April 17, 2013 @02:20AM
(#5562997)
Like a breach on Dropbox, a company that 1Password has no control over?
The dictionary files I have in /usr/share/dict/ have about half a million words. Mean length is 11 characters. And there are about 100 characters easily accessible on my keyboard (letters, numbers and common symbols).
Regular words, trying lower case, UPPER CASE or First Letter Capitalised. 3 * 0.5 million options = Half a second to search.
Same but with a two digit number before or after (e.g. Patio11): 2 * 100 * 3 * 0.5 million options = 100 seconds to search.
Single regular word with up to 4 standard keyboard characters before or after (e.g. Patio3&A@): 2 * 100^4 * 3 * 0.5 million = about 3.1 years to search.
Two regular words, same case options, with or without a space. (3 * 0.5 million)^2 * 2 = 17 days to search.
Single regular word, random capitalisation (e.g. paTIo) rough figure: 2^11 * 0.5 million = 6 minutes to search.
Single regular word, random capitalisation, 4 standard keyboard characters before or after (e.g. PaTio8#`¬): 2 * 100^4 * 2^11 * 0.5 million = 2163 years to search.
Four regular lower case words (e.g. correct battery horse staple): (0.5 million)^4 = 660000000 years to search.
Up to 10 letters or numbers, upper or lower case (e.g. nk7rFG9Ad9): 63^10 combinations = 10403 years to search.
Up to 8 letters or numbers, upper or lower case (e.g. Plfws0aX): 63^8 combinations = 2.6 years to search.
Assuming you could obtain the same 3M hashes/second on an Amazon EC2 cluster GPU instance (this isn't a given as they have nVidia GPUs instead of the ATI chip used in the test reported) 2.6 years of GPU time at the spot price of 35 cents an hour would cost $7976.85
Needless to say, if you had access to a whole load of people's 1password files, probably some of them would be following a weak password selection scheme and you'd break them within seconds. On the other hand, people with strong password selection schemes will still be safe.