Hacker News Reader

Comment by rustybolt | Hacker News Reader

> By renting a GPU cluster online, the entire chosen-prefix collision attack on SHA-1 costed us about 75k USD.

So they just decided to try their attack and spend two years worth of salary on it?? That's crazy.

You can see their emails at the bottom: those are universities/research institutes domains. You can be sure _they_ did not actually spend that themselves.

I'm just amazed that they were willing to take the risk that there was a bug in the code and they wouldn't find a collision.

It was a sound premise to investigate. EFF spent much more to demonstrate the weakness of DES decades ago, and it highlighted the need for stronger crypto and the fact that nation states would be more than able to break commonly-used crypto at the time.

This is cheap!

Breaking MD5 for the Flame malware probably set the NSA back millions when you sum the person-hours and CPU time together.

That's dirt cheap for a government actor, and we can be sure that the big governments have been doing this sort of attack for years.

It's a lot of money for an academic researcher.

Researchers in applied fields other than CS spend this kind of money on a regular basis. eg. https://www.quora.com/What-are-the-costs-for-lab-rat-testing...

Is it? Multi-million grants are common in academia. A lot of research is expensive. When I worked in a lab the materials alone for a single day's experiment would frequently run into the thousands. E.g. the total human RNA samples we used cost many thousands of dollars per milligram. Admittedly this is a different field, but it's still academia.

> Multi-million grants are common in academia.

Not in the way you explain. Multi-million dollar grants are usually awarded over multiple years, and pay for multiple researchers’ salaries, as well as other resources, some of which are expected to outlast the project (e.g. microscopes, or hardware for databases). Burning 75k on a single experiment (which is effectively what was done here) is rare.

Note that this is true even for current hot topics such as biomedical (e.g. cancer) research, for which vast chunks of the federal budget have been allocated in multiple countries. Obtaining similar sums in less sexy fields is much harder. And even in biomedical research, multi-million dollar grants are considered large. Most grants are much smaller, they just don’t get talked about as much.

Since you mention human RNA samples I assume you know this. You mention the per-milligram cost but this is pretty misleading if you mean to imply that “milligram” is somehow little, because it isn’t: yes, the samples are tiny (≤1 µg of RNA is more typical than milligrams!), but so what? It’s not like we need more.

No. It's incredibly generous and selfless. They threw that money away just to incontrovertibly prove a huge point to the entire security community (and all developers, at the end of the day).

Like... chaotic good. Really really good.

As GPU's get better the cost will come down. Was it a massive cluster of RTX2060's or something?

900 GTX-1060s.

Reply on news.ycombinator.com