Password Cracking in 2010 and Beyond
Posted
by mttr
on Stack Overflow
See other posts from Stack Overflow
or by mttr
Published on 2010-05-14T11:15:22Z
Indexed on
2010/05/14
11:54 UTC
Read the original article
Hit count: 334
I have looked a bit into cryptography and related matters during the last couple of days and am pretty confused by now. I have a question about password strength and am hoping that someone can clear up my confusion by sharing how they think through the following questions. I am becoming obsessed about these things, but need to spend my time otherwise :-)
Let's assume we have an eight-digit password that consists of upper and lower-case alphabetic characters, numbers and common symbols. This means we have 8^96 ~= 7.2 quadrillion different possible passwords.
As I understand there are at least two approaches to breaking this password. One is to try a brute-force attack where we try to guess each possible combination of characters. How many passwords can modern processors (in 2010, Core i7 Extreme for eg) guess per second (how many instructions does a single password guess take and why)? My guess would be that it takes a modern processor in the order of years to break such a password.
Another approach would consist of obtaining a hash of my password as stored by operating systems and then search for collisions. Depending on the type of hash used, we might get the password a lot quicker than by the bruteforce attack. A number of questions about this:
- Is the assertion in the above sentence correct?
- How do I think about the time it takes to find collisions for MD4, MD5, etc. hashes?
- Where does my Snow Leopard store my password hash and what hashing algorithm does it use?
And finally, regardless of the strength of file encryption using AES-128/256, the weak link is still my en/decryption password used. Even if breaking the ciphered text would take longer than the lifetime of the universe, a brute-force attack on my de/encryption password (guess password, then try to decrypt file, try next password...), might succeed a lot earlier than the end of the universe. Is that correct?
I would be very grateful, if people could have mercy on me and help me think through these probably simple questions, so that I can get back to work.
© Stack Overflow or respective owner
