# PBKDF2 without salt on 16 digit password

How secure would be to use PBKDF2 without salt (or with the same salt for all) with a 16 digits passwords that are unique and randomly generated (there can't be two identical)?

Assuming an adversary with large resources and technical know how, How fast someone would be able to identify password using 10000 or 50000 iterations?

• Passwords are randomly distributed and attacker can be very efficient and has a security know how. – user1563721 Jul 10 '16 at 19:56
• With 10k iterations, it would take roughly 180k GPU-days (with GTX 1070s) to get through the entire search space. Dedicated circuits will be faster. An attacker has to do this only about once, as he can build a rainbow table for your application then. – SEJPM Jul 10 '16 at 19:56
• How many users? When you lack unique salts, the more passwords exist, the easier it is to crack some. – otus Jul 10 '16 at 20:05
• May be 100 tousand – user1563721 Jul 10 '16 at 20:10

TL;DR: If an attacker can gain less than 50k-100k USD from breaking all the "passwords" you're fine, else you could be screwed. (for 10k iterations, using SHA-1 for PBKDF-2)

How secure would be to use PBKDF2 without salt (or with the same salt for all) with a 16 digits passwords that are unique (there can't be two identical)?

It would keep medium-scale companies and smaller attackers from getting the passwords, but would fail to do so for larger scale attackers.
The exception being of course an attacker that already has the right scale of infrastructure ready-to-use (first noted by Maarten Bodewes)

The reason for this is documented in the answer to the next (sub-)question.

How fast someone would be able to identify password using 10000 or 50000 iterations?

Let's assume you'd use 10,000 iterations (multiply everything with $5$ for 50k). This would mean to search the entire password space you'd have to do 10k SHA-1 iterations per entry. There are $10^{16}$ entries, so that's $10^{20}$ SHA-1 hashes in total.

Now let's have a look at how many SHA-1 hashes a modern GPU (a Nvidia GTX 1070) can calculate per second: 6.3GHashes/s which is $6.3\times 10^9$ hashes per second. Now multiply this with $60^2\times 24$ to get the number of hashes per day: $5.4\times 10^{14}$. So you'd need $10^{20} / (5.4\times 10^{14})\approx 180,000$ days with a single GPU. Now - just for fun - let's calculate how much 400 GTX 1070 (roughly 500€ a piece) would cost (they'd take roughly 450 days to search the entire key space): $400\times 500\approx 20k$ euro. This is the hardware cost. Additionally you'd need to pay for electricity and other stuff and if you want to be faster you need either FPGAs, better GPUs, ASICs or more GPUs. Now I think with the additional infrastructure, the deployment and the electricity you may end up at 50k-100k USD (and maybe you've bought a few more GPUs ;). So if an attacker can gain this amount of money by breaking your system, you should adapt and if not you're probably fine.

Note that this is an example calculation. An attacker could also very well try and rent high-end GPUs in the cloud, possibly reducing cost and management overhead (first noted by Maarten Bodewes).

• Note that some adversaries may already have the infrastructure in place. Also note that cloud based computing has taken flight. That could dampen the hardware cost quite a bit. – Maarten Bodewes Jul 11 '16 at 10:29