Hacker News Reader

Comment by thefreeman | Hacker News Reader

I am not an expert by any means, but I believe pbkdf2 is a recommended key stretching function for a hashing method (which looks to be sha256). http://en.wikipedia.org/wiki/PBKDF2

I think cracking difficulty depends on how many "iterations" they use though.

View on HN

I assume 12000 iterations by the looks of that $ delimited string, I assume they're storing the parameters as,

hash_func$iterations$salt$derived_key

The iterations are listed as 12000. This value is supposed to double every two years and is around 128k I believe currently.

This is probably to try to offset Moore's law, by keeping the hash cracking difficulty in line with technology progrss. But it's funny how this works. If you think about Moore's law, it's basically describing the number of transistors on an IC, those doubling every two years. But it doesn't address expansion in the ways we use our technology. If new machines come out which allow us to stack even more GPUs into a single machine, performance capacity per cracking host will rise even farther than double per year.

One person estimated an 8-GPU cracking machine two years ago at about 539 billion hashes per minute. At 128k hashes for one password, you could make about 70,182 attempts per second.

But here[1] is a five-machine cluster from a year and a half ago with 25 GPUs. Its speed? 63 billion per second against SHA1. This results in 492,187 attempts per second. Assuming SHA256 is about 50% slower, this would be around 246,093 per second.

Some password dictionaries contain millions of words. But if your password is '0Password', it'll probably be cracked in a couple of seconds on modern hardware.

[1] http://arstechnica.com/security/2012/12/25-gpu-cluster-crack...

Reply on news.ycombinator.com