# How reassuring is 64-bit (in)security?

In Feb 2017, CWI and Google announced SHAttered hash collision attack on SHA1, which took $$2^{63.1}$$ work estimated 6500 CPU years, to achieve. Therefore, 64-bit should be considered now an insecurity.

However, that's on the cloud computers of one of the largest tech company in the world, possibly taking hours if not days to find the collision. So 64-bit assurance may still be meaningful in some scenario (e.g. hash table in the implementation of associative arrays) assuming it can be correctly achieved (e.g. Gimli permutation in Sponge mode of capacity of at least 128-bit).

Also, $$2^{-64}$$ seems to be small enough a probability, that it's not uncommon that some protocols happily truncate their MAC to 64 bits, and some PQC KEMs take that as quite comfortable a margin of encryption failure probability.

So my question is: How reassuring is 64-bit security in terms of the fastest (classical) supercomputer in 2018, the IBM Summit (used in Oak Ridge National Laboratory).

• It really depends on your use-case. Eg 64-bit is fine for MACs where you drop the connection and re-negotiate as soon as you see one MAC validation error.
– SEJPM
Oct 28 '18 at 13:03
• Let's assume that brute force is possible, otherwise all the calculations are kind of pointless. My PIN has a security of around 13 bits. Oct 29 '18 at 1:06
• @MaartenBodewes Interesting enough, my PIN has a security of around 20 bits. Oct 29 '18 at 3:01

TL;DR; Just give me the numbers;

$$\begin{array} {|l|c|c|c|c|}\hline & \text{in a second} & \text{in an hour} & \text{in a day} & \text{in a year} \\ \hline \text{Summit on SHA-1} & \approx 2^{49.7} & \approx 2^{61.5} & \approx 2^{66.1} & \approx 2^{74.6} \\ \hline \text{Titan on SHA-1} & \approx 2^{49.1}& \approx 2^{61.0} & \approx 2^{65.5} & \approx 2^{74.1} \\ \hline \text{Bitcoin Miner on SHA-256D} & \approx 2^{67.1} & \approx 2^{78.9} & \approx 2^{83.5} & \approx 2^{92.09} \\ \hline \end{array}$$

1. Summit can reach $$\approx 2^{63}$$ SHA-1 hashes around 3 hours, $$\approx 2^{74.6}$$ hashes in one year.
2. Titan can reach $$\approx 2^{63}$$ SHA-1 hashes around 4 hours, $$\approx 2^{74.1}$$ hashes in one year.
3. Bitcoin miners reached $$\approx 2^{92.09}$$ SHA-256D hashes per year in 7 February 2021 ( or $$\approx 2^{93.09}$$ SHA-256)

## Performance Results of some GPU's

1. On Amazon AWS P2, up to 16 Nvidia Tesla K80 GPUs has total $$31,664.7$$ MH/s SHA-1 calculations on average per board $$\approx 1,992$$ MH/s with hashcat-3.10
2. on 8x Nvidia GTX 1080 Hashcat Benchmarks has total $$68,771.0$$ MH/s SHA-1 calculations and on averageper board $$8,596.4$$ MH/s with hashcat 3.00
3. Tesla V-100 has $$17,225$$ MH/s with hashcat 4.0, ( very big? see comparison of NVdia's)

The below tables is constructed from various web-sites [1][2][3] and not taken on average.

$$\begin{array}{|l|c|}\hline Device & MH/s \\ \hline \text{GTX 1080 TI} & 12098.4 \\ \hline \text{RTX 2070S} & 11283.1 \\ \hline \text{RTX 2080 TI} & 16823.6 \\ \hline \text{RTX 3090} & 22220.5 \\ \hline \text{Tesla T4} & 5428.3 \\ \hline \text{Tesla P100} & 9653.8 \\ \hline \text{Tesla V100} & 17535.9 \\ \hline \text{Tesla K80} & 31664.7 \\ \hline \end{array}$$

• Summit : Each VT-100 requires $$300W*27,648 = 8.29MW$$, and taking 12 cents per kilowatt-hour is an average in US, one year cost is \$8,709,120 • And, if you rent AWS using p3.16xlarge instance the $$2^{64}$$ SHA1 evaluations cost about 1M USD.SEjPM's comment ## security There are two question on this site answer the practicability of the shattered; tl;dr; for this answers; • But it is not safe, regardless of Google's attack. Before Google attacked, we knew that SHA-1 is not the best choice. • You are already too late. Migrate away from SHA-1 now. notes; 1 This calculation is based only GPUs and CPUs are slower in magnitude order. Only Titan has GPU on the Summit of Oak Ridge National Laboratory. rhea has only 9. Eos and ARM don't have any. • One may want to note that$2^{64}$SHA1 evaluations cost about 1M USD on AWS using p3.16xlarge instances. – SEJPM Oct 28 '18 at 13:20 • Depending on the application, you may need to take into account the decrease in this cost over time. A MAC or digital signature that isn't worth forging today might be trivial in 20 years. How long does your security need to last? Oct 29 '18 at 1:50 • Would these numbers apply equally to OpenPGP "long" key IDs which are the lower 64 bits of a SHA1 hash of the public key? Related: security.stackexchange.com/questions/198249/… Nov 23 '18 at 1:32 • Is it$2^{63}\$ per day or per hour for Summit? The table and the text contradict. Assuming it's per day, the estimation per year has to be corrected too.
– tleb
Oct 1 '20 at 8:06
• @tleb It should be more exact now. Also, the table extended. The approximations are only performed at the end. Still, the are approximations since I cannot access those machines to see the real performance. Oct 1 '20 at 9:50

There is a huge difference between $$2^{-64}$$ probability of failure, which is indeed very small, and having to run $$2^{64}$$ in order to carry out the attack. The latter is much too small to be considered reasonable. Of course, one could argue about protecting secrets that are not very significant and you only need weak protection. However, it is usually very problematic to argue about this. My salary (sexual preference, health situation, etc.) may not be very secret to me, but may be very secret for someone else. It also may not be very secret now but may become so later on. However, beyond all of these arguments, the chance that this is the bottleneck and problem in your application is almost zero. You should use strong cryptography and not make these types of calculations at all. Bottom line, 128-bit security is the minimum required today.