Using MS Azure to crack password

Question

I heard there is a possibility to perform a brute force attack of an password, I know there is an option to use graphic cards on AWS, but is there a solution for Azure too? Which costs would it take to perform such an attack? I know it depends on the performance, time etc., is there some pricing list on how Azure solves this? I cannot find it on google, I only found solutions for AWS.

Answer 1

It depends on many factors.

Let's make some very optimistic assumptions. Suppose the password consists of characters out of 64-character set (64 taken for simlicity, e.g. lower and upper case English letters, digits 0 to 9, and a few special characters). Suppose password has length of 12. If characters chosen randomly, entropy is 6 x 12 = 72 bits. And suppose, again very optimistically, that a simple hash like SHA-256 is sufficient to test a single password. Thus in the worst case you need to compute 2⁷² hashes.

How much can it cost?

Let's look at relatively powerful GPU NVIDIA GeForce RTX 3090, which can compute 121 MH/s. It is ~2³⁹ hashes per hour. This GPU consumes 350W, which with optimistically low price 0,1 USD per KWh means 0,035 USD per hour.

For 2⁷² hashes you would need 2⁷² / 2³⁹ = 2³³ ~= 8,600,000,000 hours of such GPU. This will cost you ~300,000,000 USD.

If encryption scheme uses a 128-bit key (which makes no sense to brute-force) which are derived with some algorithm like Argon2 from 12-character password, and its parameters slow you down let say by factor 1,000,000, then your cost will increase by this factor. Means, a 12-character password can cost you 300,000,000,000,000 USD.

The costs of such computing power at MS Azure will be higher, because there are also costs of hardware, cooling systems, personnel, etc.

If you want to brute-force an 8-character password and there is no key derivation used, then after applying the same logic we will get following: Entropy = 6 x 8 = 48 bits. Time needed to brute-force: 2⁴⁸ / 2³⁹ = 2⁹ = 512 hours ~= 21 days. Thus, even with a single GPU you can brute-force an 8-character password within 21 days, even without using MS Azure.

TLDR: Even in a relatively simple case without key derivation with 12-characters password the brute-forcing can cost ~300,000,000 USD. And if some further measures taken, e.g. password is longer or a resource hungry key derivation is used, it can cost much more.