[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAFMma9Mpw256E_O3zV1WTE--reu3SnKcyisU6FoxtVu8+HFTdg@mail.gmail.com>
Date: Fri, 5 Oct 2012 07:19:29 -0500
From: Richard Miles <richard.k.miles@...glemail.com>
To: john-users@...ts.openwall.com
Subject: Re: Password hashing at scale (for Internet companies
with millions of users) - YaC 2012 slides
Hi Solar
Very nice slides, congrats. I would like to take the opportunity to open a
discussion if you don't mind.
Based on your slides I guess that the more appropriate recommendation for
password hashing with salt is to keep using bcrypt since it's strong and at
the same time stable / well tested. Do you agree?
I was not aware this Intel Xeon Phi, based on your slides I guess it will
be much more efficient for password cracking in comparison with the current
AMD GPU, however I doubt it will have a low cost such as a AMD GPU, right?
Consequently it will not be affordable for most individuals and it will
decrease the number of implementations supporting it (example john the
ripper, hashcat, etc). So, I guess it may not be very useful for most of
us, more or less the same that happens with PICO computing.
Thanks.
On Fri, Oct 5, 2012 at 5:08 AM, Solar Designer <solar@...nwall.com> wrote:
> Hi,
>
> The slides for my YaC 2012 talk "Password hashing at scale" are now online:
>
> http://www.openwall.com/presentations/YaC2012-Password-Hashing-At-Scale/
>
> In this talk, I have focused on approaches to and challenges with
> setting up better password hashing for Internet companies with millions
> of users. Some of the topics covered are possible use of HSMs (and
> YubiHSM as a specific example), how much password stretching can be
> afforded, different password hash types (including what's wrong with
> PBKDF2, bcrypt, scrypt, possible revisions of scrypt), trade-offs with
> using memory-hard KDFs in general, possible defensive use of GPUs,
> Xeon Phi coprocessor, FPGAs.
>
> SHA-3 is deliberately not mentioned on the slides yet. I briefly
> thought of retroactively adding a few mentions of it (YaC 2012 was a day
> too early), but decided not to. SHA-3 should be similar to DES (read:
> very good) in context of possible defensive use of FPGAs. As to
> PBKDF2-HMAC-SHA-3, things are less clear, although it's probably weaker
> than PBKDF2-HMAC-SHA-512 (is it also weaker than -SHA-256? than -SHA-1?
> not sure). (In this context, "weaker" means it allows for even more
> efficient attack-optimized implementations than the other hash type,
> resulting in higher passwords tested per second rate for the same
> processing cost of defensive use.) I prefer to keep only fairly
> reliable information on the slides, and not speculate on important
> issues there (but I do speculate here, as you can see). Those of you
> who follow @solardiz on Twitter probably already know a bit more on my
> expectations and reasoning for throughput-optimized parallelized
> implementations of SHA-3, due to the too-many-tweet conversation I had
> with @marshray. ;-)
>
> Alexander
>
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
