PASSWORD GUESSING (is trivial)

[Doug Davis]

>From an actual experment I ran a few months ago on some of our machines
the password in question was "zzzzzzzz" the processors were 33mhz 68030's
doing the crunching.  If theres a good reason I might post the program.
Otherwise the program consisted of 8 for loops using pointers to reference
the "trial-string" and a very quick implmentation of the crypt() library
call. just how much quicker? roughly 20 times as fast as the implmentation
that comes with generic sysV. (It was done by making pointer references out
of everything, some in-line code, and lots of try it and see if it goes
any faster *this* way ;-) )

The purpose of this experiment was to prove that given enough computing power
and a resonably fast crypt() a person could *EASLY*, with a brute force
approach, crack passwords without any major difficulty.

Each machine was given a section of "test" data to grind, for example
machine 1 would be given "\1\0\0\0\0\0\0\0" thru "\200\200\200\200\0\0\0\0" and
so forth. They were then allowed to crunch until they finished their
tasks. 

Now then, on to the statisics.  These numbers will vary greatly with the
split of the data, i.e which set of "test data" each machine gets to perform.
In this test I recorded the time it took the last machine to complete, not
the one that actually guessed the password. 

Number of machines crunching,		 	Aprox Hours to guess password
 1                                            1012*
 4                                            209
16                                            67

*Except for one powerfailure the one machine ran for an entire 6 week period.


Now if someone has a real parallel machine or a C2 I could borrow i'ed
be glad to generate some statistics with some real computing power.. ;-)

Anyway this data should really be considered rough, When I get
some time (haha) I will be re-doing the experment under a very tight
control and probably write a paper on it.

Oh yeah, I have the same experment running on a PeeCee (286 @ 16mhz)
it's 5 weeks into it now, and not real close. However a rough guess says
20-25 weeks given where it is now and how fast it's incrementing.
Kinda gives ya the willies doesn't it? 

BTW, theres a good public domain shadow password package available from
comp.sources archives, jfh at rpp386 and others have been putting lots of
time keeping it alive.  If these numbers scare you and they did me, get
the package, compile it for double length passwords and use them.  The
time it takes to brute force a password goes up exponentially based on
it's length.

Anyway, gotta go change that password again.
doug
--
Doug Davis/1030 Pleasant Valley Lane/Arlington/Texas/76015/817-467-3740
{sys1.tandy.com, motown!sys1, uiucuxc!sys1 lawnet, attctc, texbell} letni!doug