Timeline for Estimate the time to crack passwords using bcrypt
Current License: CC BY-SA 3.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 19, 2016 at 2:46 | comment | added | cottsak | My concern re your extrapolation wasn't about the math as much as the 'point in space' for what you considered a "strong work factor". Now that you've said it's 11, I'm happy to agree that yes that is "relatively" strong, but like I think you've already alluded to, the absolute work factor is less important than the time on a given machine that the hash takes to compute. Also, I do side with the "whole second" party - it's not a poor UX for login and gives you the best bang for buck IMO. | |
| Oct 19, 2016 at 2:43 | comment | added | cottsak |
you should be quoting the combined performance of this example rig 133.1 kH/s instead of the per-GPU number 16701 H/s. It's only the combined performance that matters when you're brute forcing with a dictionary - it's the speed at which you get through the list that's matters, not the speed of an individual hash computation.
|
|
| Oct 18, 2016 at 8:35 | comment | added | Z.T. | @cottsak What is the problem with my extrapolation? The benchmark shows speed for each GPU and then speed for all 8 GPUs together. Cost of bcrypt is power of 2 for number of rounds. So cost 5 is 2^5=32 rounds and cost 11 is 2^11=2048 rounds. Since (a^x)/(a^y)=a^(x-y) so 2^11 is 2^6 =64 times more than 2^5. But some people recommend cost 17 or even whole second of CPU time (too much I think). | |
| Oct 18, 2016 at 6:35 | comment | added | Z.T. | @cottsak 16Kh/se per GPU instead of 13Kh/s is not a huge difference, but good to know. I don't know if it's cost effective to use the better GPUs. A "strong work factor" is high enough that you believe passwords your users will use will not be broken, or as strong as you are willing to do (your server will have to use CPU to compute those hashes...). My calculations above assumed 11 (64 times slower than 5). If you allow really weak passwords, nothing will help. | |
| Oct 18, 2016 at 6:18 | comment | added | cottsak |
I'm not confident in your extrapolation: what is a "strong work factor"? Can you specify the number please? Also, the latest performance data is 133 KH/s on bcrypt(05)
|
|
| Oct 14, 2016 at 2:13 | history | answered | Z.T. | CC BY-SA 3.0 |