{"id":107,"date":"2011-06-01T15:32:17","date_gmt":"2011-06-01T23:32:17","guid":{"rendered":"http:\/\/blog.mozilla.org\/webappsec\/?p=107"},"modified":"2011-06-01T15:32:17","modified_gmt":"2011-06-01T23:32:17","slug":"sha-512-follow-up-and-thank-you","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/security\/2011\/06\/01\/sha-512-follow-up-and-thank-you\/","title":{"rendered":"sha-512 follow-up and thank you"},"content":{"rendered":"

I made a statement in my previous post, SHA-512 w\/ per Users Salts<\/a> about a \u201csignificant hit rate\u201d when it comes to dictionary attacking hashes. This significant hit rate is what we are scared of because we feel that not many people really know the ease of dictionary attacking the hashes, even if you have a large salt. It should be known that hashes alone are not meant to secure passwords. Additional steps are required such as increased iterations and salts are necessary to increase the cost of both offline brute force attacks and pre-computed tables. (rainbow tables) As I pointed out in my last post, most applications store the salt with the hash. <\/p>\n

So, on my quest to prove a point and to prove how easy it is to dictionary hashes, I designed a system where we could perform dictionary attacks but under the strictest security possible. I didn\u2019t want to use a public cloud nor did I want to know the passwords. My first goal with this project was to get two metrics, how fast could I dictionary 1 million hashes and what would be the hit rate. <\/p>\n

The System<\/strong><\/p>\n

My first mission was to get a few systems for testing and since there was plenty of old desktops and Mac Book Pros around the office, I grabbed a few of these and started building my own. The first task was to build a client\/server app that got the hash from the master database and then past the hash to the worker. Once that was done, the local server had to have a database for metrics and to keep timing and hit rates. The API that I wrote between the client and server was pretty simple, auth the request, request a hash, and ack the client “got the hash.” The client also needs to be multi-threaded, which is pretty simple at this point. When the worker was completed with a hash, send a true\/false for the ability to dictionary the password and how long did it take. <\/p>\n

Once this was built, and I am over simplifying the how in this post, I started testing against sample hashes to get an idea of scale. I started off with just three worker machines, all over 1 1\/2 years old. I found that I could get an answer on any given hash under 4 seconds. The dictionary that I am using is my own dictionary, something I won\u2019t release out to the public (yet) but I will say, it has 400,000 entries. I do have a more complete dictionary that is over 10 million entries, but it takes some significant time to process this dictionary but has a much higher hit rate. <\/p>\n

Results<\/strong><\/p>\n

When I got the system tested and working, I was able to unleash it on 1 millions hashes. The results were pretty surprising in that I was able to completely process 1 million hashes in under 18 hours using just three older machines and get a 20% password hit. I did want to stress that we didn\u2019t record the password, just if we got a match. <\/p>\n

Imagine if I had more machines or even used ec2, I could cut that time down significantly. This is the biggest reason we are moving away from sha-512 and moving towards hmac with bcrypt. <\/p>\n

Thank You<\/strong><\/p>\n

On a personal note, I did want to give one last \u201cThank you\u201d to all the people in the community who I have had a chance to work with over the past 2 years. As many of you know, Friday June 3rd will be my last day at Mozilla as I am moving on to new challenges. The infrastructure security group wasn\u2019t here when I started and I\u2019m proud to say that it is now starting to put its feet down and establish itself as a \u201csecurity enabler\u201d for Mozilla and the community. The team that I am leaving behind is nothing short of top notch and will continue to be security enablers.<\/p>\n

Once again, it has been a great ride and thank you all for your support.<\/p>\n

Chris Lyon
\nDirector of Infrastructure Security (Until June 3rd)
\ntwitter: @cslyon<\/p>\n","protected":false},"excerpt":{"rendered":"

I made a statement in my previous post, SHA-512 w\/ per Users Salts about a \u201csignificant hit rate\u201d when it comes to dictionary attacking hashes. This significant hit rate is … Read more<\/a><\/p>\n","protected":false},"author":175,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[121,8629],"tags":[8627,8625,8624,8626],"coauthors":[],"yoast_head":"\nsha-512 follow-up and thank you - Mozilla Security Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.mozilla.org\/security\/2011\/06\/01\/sha-512-follow-up-and-thank-you\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Chris Lyon\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2011\/06\/01\/sha-512-follow-up-and-thank-you\/\",\"url\":\"https:\/\/blog.mozilla.org\/security\/2011\/06\/01\/sha-512-follow-up-and-thank-you\/\",\"name\":\"sha-512 follow-up and thank you - Mozilla Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/#website\"},\"datePublished\":\"2011-06-01T23:32:17+00:00\",\"dateModified\":\"2011-06-01T23:32:17+00:00\",\"author\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/ea919a02109b25695672251a83c2120e\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/2011\/06\/01\/sha-512-follow-up-and-thank-you\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.mozilla.org\/security\/2011\/06\/01\/sha-512-follow-up-and-thank-you\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2011\/06\/01\/sha-512-follow-up-and-thank-you\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.mozilla.org\/security\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"sha-512 follow-up and thank you\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#website\",\"url\":\"https:\/\/blog.mozilla.org\/security\/\",\"name\":\"Mozilla Security Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.mozilla.org\/security\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/ea919a02109b25695672251a83c2120e\",\"name\":\"Chris Lyon\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/image\/feee60d163cdfc62fe2d9c5d49cae0ec\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/279c764abcbdce6373555f5fbc43f327?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/279c764abcbdce6373555f5fbc43f327?s=96&d=identicon&r=g\",\"caption\":\"Chris Lyon\"},\"description\":\"Director of Infrastructure Security\",\"sameAs\":[\"http:\/\/cslyon.net\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"sha-512 follow-up and thank you - Mozilla Security Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.mozilla.org\/security\/2011\/06\/01\/sha-512-follow-up-and-thank-you\/","twitter_misc":{"Written by":"Chris Lyon","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/blog.mozilla.org\/security\/2011\/06\/01\/sha-512-follow-up-and-thank-you\/","url":"https:\/\/blog.mozilla.org\/security\/2011\/06\/01\/sha-512-follow-up-and-thank-you\/","name":"sha-512 follow-up and thank you - Mozilla Security Blog","isPartOf":{"@id":"https:\/\/blog.mozilla.org\/security\/#website"},"datePublished":"2011-06-01T23:32:17+00:00","dateModified":"2011-06-01T23:32:17+00:00","author":{"@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/ea919a02109b25695672251a83c2120e"},"breadcrumb":{"@id":"https:\/\/blog.mozilla.org\/security\/2011\/06\/01\/sha-512-follow-up-and-thank-you\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.mozilla.org\/security\/2011\/06\/01\/sha-512-follow-up-and-thank-you\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/blog.mozilla.org\/security\/2011\/06\/01\/sha-512-follow-up-and-thank-you\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.mozilla.org\/security\/"},{"@type":"ListItem","position":2,"name":"sha-512 follow-up and thank you"}]},{"@type":"WebSite","@id":"https:\/\/blog.mozilla.org\/security\/#website","url":"https:\/\/blog.mozilla.org\/security\/","name":"Mozilla Security Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.mozilla.org\/security\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/ea919a02109b25695672251a83c2120e","name":"Chris Lyon","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/image\/feee60d163cdfc62fe2d9c5d49cae0ec","url":"https:\/\/secure.gravatar.com\/avatar\/279c764abcbdce6373555f5fbc43f327?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/279c764abcbdce6373555f5fbc43f327?s=96&d=identicon&r=g","caption":"Chris Lyon"},"description":"Director of Infrastructure Security","sameAs":["http:\/\/cslyon.net"]}]}},"_links":{"self":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts\/107"}],"collection":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/users\/175"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/comments?post=107"}],"version-history":[{"count":0,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts\/107\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/media?parent=107"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/categories?post=107"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/tags?post=107"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/coauthors?post=107"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}