Talk:Key stretching

message: :So far computer speed has doubled about once per 1.5 years. (See Moore's law.) This means that each 1.5 years one more bit of key strength is possible to crack. This means that the 16 extra bits of strength is worth about 16×1.5 = 24 years later cracking. 
That's true only for key that can be cracked in long periods (years, not months).
Example 1:
:Let's imagine n-bit key can be cracked in 1 minute. Now, let's add 1 bit to the key: (n+1)-bit key will be cracked in 2 minutes, not 1.5 years + 1 minute.
Example 2:
:Let n-bit key can be cracked in t years with computation power growing 2x every 1.5 years (P(t) = 2^{\frac{t}{1.5}}, where t = time in years). First, let's find how many "years" (in terms of current computers) will be "calculated" in t real years:
: \int 2^{\frac{x}{1.5}}\,\mathrm{d}x = \frac{1.5}{\ln 2}\cdot2^{\frac{x}{1.5}}
: N(t) = \int_{0}^{t} 2^{\frac{x}{1.5}}\,\mathrm{d}x = \frac{1.5}{\ln 2}\cdot\left(2^{\frac{t}{1.5}}-2^{\frac{0}{1.5}}\right) = \frac{1.5}{\ln 2}\cdot\left(2^{\frac{t}{1.5}}-1\right)
: For example, if key can be cracked in 15 years with computer speed growing, current computers will crack it in:
: \frac{1.5}{\ln 2}\cdot\left(2^{\frac{15}{1.5}}-1\right) = \frac{1.5}{\ln 2}\cdot(1024-1) = 2213.8\,years (impressive, isn't it?)
: Now let's add 1 bit to the key. It requires 2x calculations(but not computation power!). Let's calculate how fast it can be cracked:
: N\left(t_{2}\right)=2\cdot N(t_{1})
: \frac{1.5}{\ln 2}\cdot\left(2^{\frac{t_{2}}{1.5}}-1\right) = 2\cdot\frac{1.5}{\ln 2}\cdot\left(2^{\frac{t_{1}}{1.5}}-1\right)
: 2^{\frac{t_{2}}{1.5}} = 2\cdot 2^{\frac{t_{1}}{1.5}}-1
: \frac{t_{2}}{1.5} = log_{2}(2\cdot 2^{\frac{2t_{1}}{3}}-1)
: t_{2}(t_{1}) = 1.5\cdot log_{2}(2\cdot 2^{\frac{2t_{1}}{3}}-1)
: Examples:
: t_{2}(1\, month) = t_{2}(\frac{1}{12}) = 1.5\cdot log_{2}\left(2^{\frac{38}{36}}-1\right) =\frac{1.96}{12}= almost\, 2\, months.
: t_{2}(1) = 1.5\cdot log_{2}\left(2^{\frac{5}{3}}-1\right) =1.681=(1+0.681)\, years.
: t_{2}(3) = 1.5\cdot log_{2}\left(2^{3}-1\right) =4.211=(3+1.211)\, years.
: t_{2}(6) = 1.5\cdot log_{2}\left(2^{5}-1\right) =7.431=(6+1.431)\, years.
: t_{2}(15) = 1.5\cdot log_{2}\left(2\cdot 2^{\frac{2\cdot 15}{3}}-1\right) = 1.5\cdot log_{2}(2^{11}-1) =16.4989=(15+1.4989)\, years.
:So, everything is correct, but for longer periods. :)
:— lim 18:19, 31 August 2007 (UTC)
replies: text: No, you have misunderstood what that paragraph means. Say you have a X bit "weak key". And that your attacker with his supercomputer can crack that key in about 2 months. But the attacker only thinks the kind of target you are are worth about 1 month of supercomputer time. So you are to expensive for them to attack so they will use their supercomputer for other targets. (Easier targets or targets more worth to attack for them.) But in about 1.5 years they will have a twice as fast supercomputer. And then it will only take them about 1 month to crack your key. Then they think it is worth it and will crack your key. But if you have applied 216 key strengthening rounds to your key they will not be able to crack that "stronger key" even with their new supercomputer. Since it would take them 216 months to crack with that supercomputer. (That is 5461 years mind you.) So they will instead have to wait 16 * 1.5 years = 24 years until they have bought a fast enough supercomputer to do the cracking in one month of supercomputer time. --David Göthberg 00:08, 1 September 2007 (UTC)
replies: text:  Ok, it was too simple for me to understand. :) Still, what I said is also true. — lim 11:26, 1 September 2007 (UTC)
thread_title:  +1.5 years/bit 

message: The article states that "Moore's law asserts that computer speed doubles roughly every 1.5 years." This is incorrect. Moore predicted that transistor count would double every 2 years. David House, a colleague at Intel, further predicted that this meant performance would double every 1.5 years. Thus, it was a prediction, not an assertion. And it was House, not Moore who made the prediction. --2601:200:4500:5F7:55D3:43CF:BB91:F205 (talk) 17:32, 20 February 2020 (UTC)
thread_title:  Inaccurate statement about Moore's Law 

message: The article might need a minor update to reflect increases in computing power - it currently cites "today" as 2006. Socrates2008 (Talk) 11:49, 6 March 2008 (UTC)
thread_title: Update

message: This section has 2 errors.  
First, it states that the slowest personal computers can do 65,000 guesses per second, but highly optimized hardware can only go 5 times as fast (300,000 keys per second)? This seems bogus.
Second, it seems to confuse multiplication and division in the paragraph, which is a serious error: "Such a design can try about 300,000 keys/second for the algorithm proposed above.  It's worth noting that the key stretching still slows down the attacker in such a situation, i.e. a $5000 design attacking a straight SHA-1 hash would be able to try 300,000*2^16 = 20 billion keys/second."
If the hardware can try 300,000 keys per second, but the key stretching is at 65000 (2^16), then it an attacker can only try about 4.5 keys per second (300,000 DIVIDED-BY 2^16). Javaman411 (talk) 14:35, 1 August 2011 (UTC)
thread_title:  Strength and Time Section Errors 

message: "Note that PBKDF2 is not for generating a hash of a password, but an encryption key from a password. PBKDF2 can be used for both if the number of output bits is less than or equal to the internal hashing algorithm used in PBKDF2 which is usually SHA-1 (160 bits)."
The original purpose of PBKDF2 is to generate encryption keys which is not the same as generating a password hashes.
 function pbkdf2_sha1($pw, $salt, $rounds, $outputBits)
 {
     $ret = "";
     $loops = ceil($outputBits / 160);
     for ($loop = 0; $loop < $loops; $loop++)
     {
         $hash = $hashOut = hash_hmac('sha1', $salt . pack('N', $loop), $pw, true);
         for ($a = 1; $a < $rounds; $a++)
         {
             $hash = hash_hmac('sha1', $hash, $pw, true);
             for ($b = 0; $b < 20; $b++)
                 $hashOut{$b} = chr(ord($hashOut{$b}) ^ ord($hash{$b}));
         }
         $ret = $ret . $hashOut;
     }
     return substr($ret, 0, ceil($outputBits / 8));
 }
Let's say someone does "pbkdf2_sha1($pw, $salt, 1000, 256)" this means the server will need to do 2000 SHA1-HMACs, but an attacker will only need to generate "pbkdf2_sha1($pw, $salt, 1000, 160)" to test a password which is only 1000 SHA1-HMACs. This is why PBKDF2 is not for generating a hash of a password... unless "the number of output bits is less than or equal to the internal hashing algorithm used in PBKDF2". An alternative is to use PBKDF2 to generate an encryption key and encrypt a known value such as "$hash = mcrypt_ecb(MCRYPT_RIJNDAEL_256, pbkdf2_sha1($pw, $salt, 1000, 256), 'a known value', MCRYPT_ENCRYPT);"
Someone should remove the dubious tag. I originally wrote that so I feel that I shouldn't remove the tag.
SteveT84 (talk) 03:08, 6 August 2011‎ (UTC)
I consider hashing a password to be used for password authentication which is not necessarily clear, and I didn't realize this until I just ran across this article again. I've fixed it and removed the dubious tag.
SteveT84 (talk) 00:53, 13 August 2012 (UTC)
thread_title:  PBKDF2 is not for generating a hash of a password 

message: I see in the comments above that they assume things in the "Strength and time" section, like that the numbers mean "streched" or "normal" hashes, etc.
I can't tell (despite that when I read "can do about 65000 sha1 hash per second" it means to me that the computer computes that amount of hashes, and not that it computes that amount of streched values from keys), but here are some actual numbers of real hashing:
* PC with 8×Nvidia GTX 2080
sha1:               	68.000.000.000 hash/s
sha256:             	23.000.000.000 hash/s
sha512:             	8.600.000.000 hash/s
sha3:               	6.500.000.000 hash/s
bcrypt(5):          	105.700 hash/s
(for work factor 15 it's \frac{105700}{2^{15-5}} = 103 hash/sec)
sha256crypt:        	3.100.000 hash/s
And with stretching:	
pbkdf2-sha1(1000 r):	26.000.000 hash/s
pbkdf2-sha256:      	9.400.000 hash/s
pbkdf2-sha512:      	3.400.000 hash/s
Also, one commenter mentioned that using future telling skills we expect that hash values improve 55% annually, which is exciting and scary at once. --grin ✎ 13:51, 10 October 2017 (UTC)
thread_title:  Hashing speed, 2017 

message: The claim that hardware hashing somehow defeats key stretching is untrue.  Granted, a dedicated hardware hasher is drastically cheaper than a software implementation on a general-purpose CPU, but those extra 16 bits of effective key length still increase the cost of attack 65536 times, no matter if you run on an ASIC or a cluster of ZX-Spectrums.  You pay less for an operation, but the ratio of numbers of operations to do remains the same.
Memory-intensive hashes are great for increasing the cost of attack, but they still scale the same. -KiloByte (talk) 18:30, 18 May 2019 (UTC)
thread_title:  Not "vulnerable" to hardware hashing 

message: 12345 193.186.196.233 (talk) 10:02, 21 March 2023 (UTC)
thread_title:  ahmin