Re: Validation flaw addressed in version 2.14
Jeff Gilchrist <[email protected]>
| Newsgroups | gmane.comp.security.passwordsafe.devel |
|---|---|
| Message-ID | <[email protected]> |
On 11/24/05, Rony Shapiro <[email protected]> wrote: > My intuition is that 1000 iterations of a hash function slows down any > brute-force attack by three orders of magnitude. Even with today's hardware, > that's a significant speed bump. > > Any more, and weak machines would take too much time for legitimate > authentication... again, by my intuition. > > If anybody has some hard data that says otherwise, I'dbe glad to hear it. I did some quick benchmarks with SHA-1 taking a 20byte text string, hashing it, and then repeatingly hashing the output of the hash for 1000, 10000, and 10000 times on a few different machines to get an idea of how long it takes. Based on my results, doing 1000 iterations would be no problem for all but the most dated systems. More than 5 year ago when I was at Entrust, we were hashing the profile password 10000 times if I remember correctly. Even back then it was not a problem for slower machines. Taking less than a second to authenticate to Password Safe is more than reasonable. With SHA-1 you can easily obtain that even with 100000 iterations. If you are going to change the database format, I would also suggest going with a different hash algorithm like SHA-256 while you are at it. **** Pentium3 866 MHz **** Benchmarking 1000 SHA-1 hash iterations... Wall Clock: 0.002444 seconds Benchmarking 10000 SHA-1 hash iterations... Wall Clock: 0.024180 seconds Benchmarking 100000 SHA-1 hash iterations... Wall Clock: 0.240746 seconds **** Pentium4 1.4 GHz **** Benchmarking 1000 SHA-1 hash iterations... Wall Clock: 0.003000 seconds Benchmarking 10000 SHA-1 hash iterations... Wall Clock: 0.017000 seconds Benchmarking 100000 SHA-1 hash iterations... Wall Clock: 0.161000 seconds **** Pentium4 3.0 GHz **** Benchmarking 1000 SHA-1 hash iterations... Wall Clock: 0.000871 seconds Benchmarking 10000 SHA-1 hash iterations... Wall Clock: 0.008133 seconds Benchmarking 100000 SHA-1 hash iterations... Wall Clock: 0.088049 seconds Jeff. ------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Do you grep through log files for problems? Stop! Download the new AJAX search engine that makes searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! http://ads.osdn.com/?ad_idv37&alloc_id865&op=click