Friday 15 April 2011

security - Password strength checkers that take into account Moore's Law? -


I was about to change my annual password on my accounts and to try different sites (Microsoft, Endeps, Etc.) tried some empirical fictional passwords Some sites seem to be a bit more deeper in comparison to other sites in evaluating the power of passwords, but this made me wonder if any site Moors would keep in mind the law. That's it, about one Hears that "it would take 130,000 years to crack the password X", but it takes into account that the computer can be doubled in speed every two years?

I would be really curious to see if these sites lead to this account, or if there is a site that someone can suggest?

None of these calculations actually take law into account law. But we see why we can show why we do not have it:

Moore's law states that the power of processing will be doubled in every 18 months (but not for our purposes Is enough)

So this means that today, 130 years, it will be 65 years in 18 months. And 32.5k in 36 months, and so on, and so on.

We can come up with an equation for that!

  Price-time-time = cost- today * 0.5 ^ (month / 18)   

So today the cost of plugging, we can see this good (X is the year):

  y = 130000 * .5 ^ (x / 1.5)   

So, let's see that in our 50 years of 130k years What will be our cost for password:

  y = 130000 * .5 ^ (50 / 1.5) y = 130000 * .5 ^ 33.3333 y = 0.000012 years (~ 6.3 minutes)   

It's very fast!

How about 10 years?

  Y = 130000 * .5 ^ (10 / 1.5) y = 130000 * .5 ^ 15 y = 1279 years   

it is still very strong It is ...

However. It also remembers the point of tunable algorithms, such as the bibliographies and scripts that are designed to be able to defeat Moore's law.

So if you use a script, script or PBKDF2, and tuning the cost, then it is a constant time, your password which today is cracked for 130k years (estimated), now It will also take 130 years to crack in 50 years.

Now, of course, the matter is not resolved where an attacker is stealing the password hash today, and attacks him in the next 50 years ... but I have to ask what your password is Would that a crypto-stupid attempt to attack next 50 years?

security

No comments:

Post a Comment