0
$\begingroup$

The developers claim that a 6 letter long password hashed with 3.8 second's of scrypt would cost $900 to brute-force.

  • If we use more cycles, how quickly will the brute force cost increase?
  • What are the minimum system requirements to compute such a huge KDF on a desktop or mobile?
  • Is there any formula to estimate its entropy based on CPU cycle time?
  • Does Scrypt survive from Grover's algorithm?

Please consider that bad passwords can be very long.

Improve this question
$\endgroup$
1
  • 1
    $\begingroup$ "Is there any formula to estimate its entropy based on CPU cycle time?" The run time of scrypt does not indicate the amount of entropy in password. Instead, if necessary, the entropy of password/passphrase needs to be estimated with some other means (such as if password is based on dictionary, checking what is the character set the password is based on (letters/letters and numbers/also special characters) and so on). $\endgroup$
    – user4982
    Commented Dec 17, 2013 at 19:43

2 Answers 2

Reset to default
1
$\begingroup$

You have to test it on the hardware you'll be using. I tried CryptSharp's implementation with a cost of 262144 and it took about 7 seconds. The reason it costs more is cause of the memory it uses, and my process that was running the Scrypt was eating up 340ish MB.

How much of that was from the KDF? Don't know.

How would my box handle 100 people authenticating at the same time? Very good question.

This is something you need to performance tune to specific hardware.

Improve this answer
$\endgroup$
1
$\begingroup$

The developers claim that a 6 letter long password hashed with 3.8 seconds of scrypt would cost $900 to brute-force.

Very important: This is the cost of finding the password within a year by building an ASIC in 2002.

Not so important: There seems to be only one person behind scrypt: Colin Percival.

If we use more cycles, how quickly will the brute force cost increase?

The most expensive part (this is the whole point of scrypt) of an ASIC would be the memory. Doubling the cycles means that you use twice as much memory for twice as much time, i.e., doubling the cycles makes a brute-force attack roughly 4 times as expensive.

What are the minimum system requirements to compute such a huge KDF on a desktop or mobile?

The parameters used in the example taking 3.8 seconds are $(N,r)=(2^{20},8)$. Theorem 2 of the scrypt paper says you need $128Nr$ bytes of memory, so the computer has to have at least 1 GiB of RAM.

Please consider that bad passwords can be very long.

Length is irrelevant. The cost of brute-forcing a password is determined by $(N,r)$ and the password's entropy.

Improve this answer
$\endgroup$
3
  • $\begingroup$ "Very important: This is the cost of finding the password within a year by building an ASIC in 2002." ... Or in case the attacker had around 20 computers (circa 2002 model or newer) laying around, the attacker could crack the 6 letter password in one year with them. (Assuming the parameters from scrypt paper.) $\endgroup$
    – user4982
    Commented Dec 17, 2013 at 19:30
  • $\begingroup$ @user4982: You can try to brute-force a password with pretty much every programmable electronic device with enough memory, but the estimated costs of the slides (and paper) use 2002 ASIC technology. $\endgroup$
    – Dennis
    Commented Dec 17, 2013 at 19:41
  • $\begingroup$ True. I just wanted to highlight the fact that sufficient computing power is within reach of just about anybody and that you do not need to use ASIC or FPGA. Calculating cost in ASIC devices is bit inconvenient as custom ASIC devices are either made in huge quantities or they will in fact cost more than $900 per device. $\endgroup$
    – user4982
    Commented Dec 17, 2013 at 19:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.