Re: Should Roundup replace current password hash with a new one.

Hi Thomas:

In message <[email protected]>,
"John P. Rouillard" writes:
>Hi Thomas:
>
>In message <[email protected]>,
>Thomas Arendsen Hein writes:
>>100000 rounds with SHA1 on an AMD Opteron 6128 are fine, we
>>use this in Moin wikis, I'm a bit scared to try 2000000
>>though :)
>
>Understandable. If you know the time to calculate 100,000
>rounds multiply by 20 to see what 2,000,000 will be. You
>can at least calculate the expected login time.
>
>On my underpowered 5 year old desktop runs an Intel(R)
>Core(TM) i3-7100 CPU @ 3.90GHz. 2,000,000 rounds of PBKDF2
>with *SHA512* takes 1.3+/-0.03 seconds.  With 300,000 rounds
>of PBKDF2-SHA512 takes 0.2+/-0.02 seconds.
>
>The ratio of 2,000,000/300,000 is 6.6 and 0.2sx6.6=1.3s. So
>this looks pretty predictable. I expect using SHA1 rather
>than SHA512 to be even faster.

I added a perftest command to roundup-admin. I thought about adding
this as a stand alone command. That brings up a can of worms for pip
installs as it would have to be installed on the path for a user to
find it....

Also I would have to generate a configuration to mimic how it's used
in the code. So I just added it to roundup-admin. It has the side
effect of migrating the database but that should be done anyway.  The
times are (using time.perf_counter())

  Hash time: 1.322110308s scheme: PBKDF2S5 rounds: 2000000
  Hash time: 0.198313966s scheme: PBKDF2S5 rounds: 300000

  Hash time: 0.611859104s scheme: PBKDF2 rounds: 2000000
  Hash time: 0.031067693s scheme: PBKDF2 rounds: 100000

Invoked (in my development tree) with:

  python3 roundup/scripts/roundup_admin.py -i demo perf \
    scheme=PBKDF2 rounds=100000

Using python 2 is about the same (using time.clock()):

  Hash time: 1.330005000s scheme: PBKDF2S5 rounds: 2000000
  Hash time: 0.198160000s scheme: PBKDF2S5 rounds: 300000

  Hash time: 0.610777000s scheme: PBKDF2 rounds: 2000000
  Hash time: 0.030481000s scheme: PBKDF2 rounds: 100000

If somebody watching at home wants to benchmark this on different
hardware, DO NOT USE an existing tracker home. It will upgrade the
schema to version 8. You don't want that.

Download:

    https://sourceforge.net/code-snapshots/hg/r/ro/roundup/code/roundup-code-1f3418a3fd3e307544d139dbd110a7ced17fbc03.zip

unzip it and cd to the new directory.

  pythonX ./demo.py

replace X with 2 or 3. Use ^C to exit the demo.

Then run:

  pythonX roundup/scripts/roundup_admin.py -i demo perftest \
          scheme=PBKDF2 rounds=3.000,000

etc. 'roundup_admin help perftest' for details.

Have a great weekend.
--
				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.