RUHR-UNIVERSITÄT BOCHUM High-Speed Implementation of bcrypt Password Search using Special-Purpose Hardware 10. December 2014 Horst Görtz Institute for IT-Security Ruhr University Bochum Friedrich Wiemer and Ralf Zimmermann Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 1
RUHR-UNIVERSITÄT BOCHUM Outline Motivation 1 bcrypt 2 Design of Implementation 3 Results 4 Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 2
RUHR-UNIVERSITÄT BOCHUM Motivation Password Hashing Function? Can’t we just store passwords in plain? 1 blog.ebay.com/ebay-inc-ask-ebay-users-change-passwords 2 blogs.adobe.com/conversations/2013/10/important-customer-security-announcement.html Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 3
RUHR-UNIVERSITÄT BOCHUM Motivation Password Hashing Function? Can’t we just store passwords in plain? 12 1 blog.ebay.com/ebay-inc-ask-ebay-users-change-passwords 2 blogs.adobe.com/conversations/2013/10/important-customer-security-announcement.html Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 3
RUHR-UNIVERSITÄT BOCHUM Motivation Secure Storage? MD5 MD5 SHA{1, 2, 3} SHA{1, 2, 3} . . . . . . Password Hash Salt Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 4
RUHR-UNIVERSITÄT BOCHUM Motivation Secure Storage? MD5 MD5 SHA{1, 2, 3} SHA{1, 2, 3} . . . . . . Password Hash Salt don’t use standard hash functions Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 4
RUHR-UNIVERSITÄT BOCHUM Motivation Secure Storage! PBKDF2 bcrypt Cost scrypt Password Hash Salt Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 5
RUHR-UNIVERSITÄT BOCHUM Motivation Why do we care? password cracking has an inherent parallel structure FPGAs enable to exploit this parallelism bcrypt claims to resist hardware optimizations currently available implementations 3 suffer from interface bottlenecks and instable operations 3 K. Malvoni et al. Are Your Passwords Safe: Energy-Efficient Bcrypt Cracking with Low-Cost Parallel Hardware 8th USENIX Workshop on Offensive Technologies (WOOT 14), 2014 Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 6
RUHR-UNIVERSITÄT BOCHUM What is bcrypt? Introduced in 1999 by Provos and Mazières. 4 Implemented in OpenBSD 2.1, Ruby on Rails, and PHP as standard password hash. bcrypt cost-parameterized based on modified Blowfish 4 www.usenix.org/events/usenix99/full_papers/provos/provos.pdf Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 7
RUHR-UNIVERSITÄT BOCHUM What is bcrypt? Introduced in 1999 by Provos and Mazières. 4 Implemented in OpenBSD 2.1, Ruby on Rails, and PHP as standard password hash. bcrypt Blowfish symmetric blockcipher cost-parameterized Feistel network based on modified Blowfish 4 www.usenix.org/events/usenix99/full_papers/provos/provos.pdf Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 7
RUHR-UNIVERSITÄT BOCHUM bcrypt Structure setup state, using the password and salt as key with modified Blowfish key schedule encrypt magic value output ciphertext as hash Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 8
RUHR-UNIVERSITÄT BOCHUM bcrypt Structure Work needs ( 2 cost + 1 + 1 ) · 521 setup state, using the password and salt as key Blowfish encryptions (roughly 2 cost + 10 ) with modified Blowfish key schedule encrypt magic value needs 3 · 64 Blowfish encryptions output ciphertext as hash Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 8
RUHR-UNIVERSITÄT BOCHUM Implementation Cracker Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 9
RUHR-UNIVERSITÄT BOCHUM Target Platforms Low cost, low power FPGA Zedboard Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 10
RUHR-UNIVERSITÄT BOCHUM Target Platforms Low cost, low power FPGA High Performance FPGA Zedboard Virtex-7 Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 10
RUHR-UNIVERSITÄT BOCHUM Optimization Optimization Goal? Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 11
RUHR-UNIVERSITÄT BOCHUM Optimization Low Area Footprint (bcrypt) Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 12
RUHR-UNIVERSITÄT BOCHUM Optimization Low Area Footprint (bcrypt) High-Speed (Blowfish) Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 12
RUHR-UNIVERSITÄT BOCHUM Design First Attempt 100 MHZ (BUSCLK) 100 MHz (BCRCLK) bcrypt Password Core Generator Salt Register bcrypt Core bcrypt Password Core Memory Interface bcrypt Password Hash Register Internals Memory bcrypt Core bcrypt Core Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 13
RUHR-UNIVERSITÄT BOCHUM Design First Attempt 100 MHZ (BUSCLK) 100 MHz (BCRCLK) bcrypt Password Core Generator Salt Register bcrypt Core bcrypt Password Core Memory Interface bcrypt Password Hash Register Internals Memory bcrypt Core bcrypt Core Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 13
RUHR-UNIVERSITÄT BOCHUM Design Quad Core 100 MHZ (BUSCLK) 100 MHz (BCRCLK) bcrypt bcrypt bcrypt bcrypt Quad Core Quad Core Quad Core Quad Core Salt Register bcrypt bcrypt bcrypt bcrypt Quad Core Quad Core Quad Core Quad Core Interface Quad Core Password Hash Register bcrypt bcrypt Generator bcrypt Core Core Quad Core Password bcrypt bcrypt bcrypt Memory Core Core Quad Core Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 14
RUHR-UNIVERSITÄT BOCHUM Design Blowfish Core One Round Left i Right i f S0 P i S1 S2 S3 Left i+1 Right i+1 Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 15
RUHR-UNIVERSITÄT BOCHUM Design Blowfish Core One Round Problematic SBox addresses can not Left i Right i be computed in the same f clock as the look up is S0 P i S1 used S2 S3 needs 2 clock cycles per round Left i+1 Right i+1 Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 15
RUHR-UNIVERSITÄT BOCHUM Design Blowfish Core Retimed Retimed Round Prefetch Input Left Input Right Left i Right i f S0 S1 P 1 S2 P i+1 S3 Left i+1 Right i+1 Left 1 Right 1 Advantages needs only 1 clock per round Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 16
RUHR-UNIVERSITÄT BOCHUM Resulting Resources Zedboard estimations for one zedboard: 40 cores as upper bound, BRAMs as limiting resource first design attempt (password in registers): 12 cores fit, LUT utilization way to high Quad Core Design: 40 cores fit, while using “big” interface Virtex-7 Quad Core Design: 316 cores per FPGA Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 17
RUHR-UNIVERSITÄT BOCHUM Resulting Resources Resource utilization of design and submodules LUT FF Slice BRAM Overall 64.8% 13.06% 93.29% 95.71% Quad Core 2,777 720 801 13 Single Core 617 132 197 3 Blowfish Core 354 64 71 0 Password Generator 216 205 81 0 Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 18
RUHR-UNIVERSITÄT BOCHUM Resulting Hashrates Compared to cost factor 5 cost factor 12 Hashes Hashes Hashes Hashes Second Watt Second Second Watt Second Zedboard 6,511 1,550 51.95 12.37 Malvoni (GSoC) 780 Malvoni et al. 4,571 682.24 64.83 9.68 Virtex-7 51,437 2,572 410.4 20.52 Xeon E3-1240 6,210 20.7 50 0.17 GTX 750 Ti 1,920 6.4 15 0.05 Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 19
RUHR-UNIVERSITÄT BOCHUM Brute Force Attack Cost 5 CPU ∗ break-even GPU ∗ CPU+GPU ∗ 20 Total costs in $1 000 000 Virtex-7 zedboard Malvoni et al. 15 10 7 5 5 10 15 20 25 30 35 40 45 50 Number of attacked passwords Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 20
RUHR-UNIVERSITÄT BOCHUM Questions? Thank you for your attention! Images: Wikimedia Commons, flickr Friedrich Wiemer and Ralf Zimmermann | High-Speed Implementation of bcrypt Password Search | 10. December 2014 21
Recommend
More recommend
