Evaluation of Standardized Password-based Key Derivation against Parallel Processing Platforms
Horst Gortz Institute for IT-Security, Ruhr-University Bochum
Lecture Notes in Computer Science, Computer Security – ESORICS 2012, Volume 7459, pp 716-733, 2012
@article{durmuth2012evaluation,
title={Evaluation of Standardized Password-Based Key Derivation against Parallel Processing Platforms},
author={D{"u}rmuth, Markus and G{"u}neysu, Tim and Kasper, Markus and Paar, Christof and Yalcin, Tolga and Zimmermann, Ralf},
journal={Computer Security–ESORICS 2012},
pages={716–733},
year={2012},
publisher={Springer}
}
Passwords are still the preferred method of user authentication for a large number of applications. In order to derive cryptographic keys from (human-entered) passwords, key-derivation functions are used. One of the most well-known key-derivation functions is the standardized PBKDF2 (RFC2898), which is used in TrueCrypt, CCMP of WPA2, and many more. In this work, we evaluate the security of PBKDF2 against password guessing attacks using state-of-the-art parallel computing architectures, with the goal to find parameters for the PBKDF2 that protect against today’s attacks. In particular we developed fast implementations of the PBKDF2 on FPGA-clusters and GPU-clusters. These two families of platforms both have a better price-performance ratio than PCclusters and pose, thus, a great threat when running large scale guessing attacks. To the best of our knowledge, we demonstrate the fastest attacks against PBKDF2, and show that we can guess more than 65% of typical passwords in about one week.
February 14, 2013 by hgpu
