Are Your Passwords Safe: Energy-Efficient Bcrypt Cracking with Low-Cost Parallel Hardware

Transcription

1 Are Your Passwords Safe: Energy-Efficient Bcrypt Cracking with Low-Cost Parallel Hardware Katja Malvoni (kmalvoni at openwall.com) Solar Designer (solar at openwall.com) Josip Knezovic (josip.knezovic at fer.hr) KatjaAre Malvoni, Your Passwords Solar Designer, Safe: Energy-Efficient Josip Knezovic Bcrypt Cracking with Low-Cost Parallel Hardware August 19, / 21

2 Motivation Bcrypt is: Slow Sequential Designed to be resistant to brute force attacks and to remain secure despite hardware improvements You could almost think why even bother optimizing KatjaAre Malvoni, Your Passwords Solar Designer, Safe: Energy-Efficient Josip Knezovic Bcrypt Cracking with Low-Cost Parallel Hardware August 19, / 21

3 But KatjaAre Malvoni, Solar Designer, Josip Knezovic Bcrypt Cracking with Low-Cost Parallel Hardware Your Passwords Safe: Energy-Efficient August 19, / 21

4 Outline 1 Bcrypt 2 Implementations Parallella/Epiphany ZedBoard and ZC706 3 Experimental Results 4 Future work 5 Takeaways KatjaAre Malvoni, Your Passwords Solar Designer, Safe: Energy-Efficient Josip Knezovic Bcrypt Cracking with Low-Cost Parallel Hardware August 19, / 21

5 Bcrypt Bcrypt Based on Blowfish block cipher Expensive key setup User defined cost setting Pseudorandom memory accesses Blowfish. Photo source: KatjaAre Malvoni, Your Passwords Solar Designer, Safe: Energy-Efficient Josip Knezovic Bcrypt Cracking with Low-Cost Parallel Hardware August 19, / 21

6 Implementations Parallella/Epiphany Architecture Epiphany 16/64 32-bit RISC cores operating at up to 1 GHz/800 MHz Energy-efficient - 2 W maximum chip power consumption 32 KB of local memory per core FPU can be switched to integer mode KatjaAre Malvoni, Your Passwords Solar Designer, Safe: Energy-Efficient Josip Knezovic Bcrypt Cracking with Low-Cost Parallel Hardware August 19, / 21

7 Implementations Parallella/Epiphany Implementation Epiphany John the Ripper prepares data on ARM cores Bcrypt hashes computed on Epiphany Optimized in assembly Each Epiphany core computes two bcrypt hashes Computation overlapped to exploit dual-issue architecture Integer ALU FPU in integer mode KatjaAre Malvoni, Your Passwords Solar Designer, Safe: Energy-Efficient Josip Knezovic Bcrypt Cracking with Low-Cost Parallel Hardware August 19, / 21

8 Implementations ZedBoard and ZC706 Architecture Zynq 7020 and Zynq 7045 Heterogeneous device Dual ARM Cortex-A9 MPCore Advanced low power 28nm programmable logic Zynq times bigger than Zynq 7020 AXI buses used for CPU-FPGA communication KatjaAre Malvoni, Your Passwords Solar Designer, Safe: Energy-Efficient Josip Knezovic Bcrypt Cracking with Low-Cost Parallel Hardware August 19, / 21

9 Implementations ZedBoard and ZC706 Implementation Zynq 7020 and Zynq 7045 John the Ripper prepares data on ARM cores Bcrypt instances compute hash(es) KatjaAre Malvoni, Your Passwords Solar Designer, Safe: Energy-Efficient Josip Knezovic Bcrypt Cracking with Low-Cost Parallel Hardware August 19, / 21

10 Implementations ZedBoard and ZC706 Implementation Number of concurrent instances Number of concurrent instances limited by available BRAM Overlapping multiple bcrypt instances in one module 56, 70 or 112 instances on Zynq 7020 with 140 BRAMs or many more on Zynq 7045 with 545 BRAMs Large communication overhead for low bcrypt cost setting Hardware defects of boards limit optimizations KatjaAre Malvoni, Your Passwords Solar Designer, Safe: Energy-Efficient Josip Knezovic Bcrypt Cracking with Low-Cost Parallel Hardware August 19, / 21

11 Experimental Results Epiphany vs x86 6,000 Performance (c/s) Energy-efficiency (c/s/w) 5,000 4,812 4,876 4,000 3,000 2,000 2,400 1,000 1,207 1, Epiphany 16 T7200 Epiphany 64 i7 2600K KatjaAre Malvoni, Your Passwords Solar Designer, Safe: Energy-Efficient Josip Knezovic Bcrypt Cracking with Low-Cost Parallel Hardware August 19, / 21

12 Experimental Results Performance and efficiency comparison 25,000 Performance (c/s) Energy-efficiency (c/s/w) 20,000 20,583 15,000 10,000 5, ,044 4,571 4,812 3,522 4,116 4,556 2,285 2,400 1, ,246 6,596 5, Epiphany 16 Zynq 7020 Epiphany 64 Zynq 7020 Zynq 7045 HD 7970 FX 8120 Xeon Phi 5110P i7 4770K (emulated with 7045) KatjaAre Malvoni, Your Passwords Solar Designer, Safe: Energy-Efficient Josip Knezovic Bcrypt Cracking with Low-Cost Parallel Hardware August 19, / 21

13 Experimental Results Cost comparison System price (c/s/$) Chip or device price (c/s/$) $99 $75 $199 - $395 $119 $2495 $ $549 $505 $205 - $2649 $650 $350 Epiphany 16 Epiphany 64 Zynq 7020 Zynq 7045 HD 7970 FX 8120 Xeon Phi 5110P i7 4770K KatjaAre Malvoni, Your Passwords Solar Designer, Safe: Energy-Efficient Josip Knezovic Bcrypt Cracking with Low-Cost Parallel Hardware August 19, / 21

14 Experimental Results Derived performance from cost 12 35,000 Performance for cost 12 (c/s) Theoretical performance for cost 5 (c/s) Measured performance for cost 5 (c/s) 30,000 28,462 25,000 20,000 20,538 15,000 10,000 5, ,112 6,313 6,246 6,753 6,596 5,347 4,571 4,556 5,408 4,490 1,207 1, Epiphany 16 Zynq 7020 Zynq 7045 HD 7970 FX 8120 Xeon Phi 5110P i7 4770K KatjaAre Malvoni, Your Passwords Solar Designer, Safe: Energy-Efficient Josip Knezovic Bcrypt Cracking with Low-Cost Parallel Hardware August 19, / 21

15 Experimental Results Theoretical Peak Performance Analysis Theory c/s = N ports f (2 cost ) N reads 16 N ports - number of available read ports to local memory or L1 cache N reads - number of reads per Blowfish round 2 cost number of Blowfish block encryptions in bcrypt hash computation f (in Hz) - clock rate EksBlowfish Ekspensive key schedule Blowfish bcrypt(cost, salt, pwd) Bcrypt (1) 1: state InitState() 2: state ExpandKey(state, salt, key) 3: repeat(2 cost ) 4: state ExpandKey(state, 0, salt) 5: state ExpandKey(state, 0, key) 6: ctext OrpheanBeholderScryDoubt 7: repeat(64) 8: ctext EncryptECB(state, ctext) 9: return Concatenate(cost, salt, ctext) Katja Malvoni and Solar Designer Energy-efficient bcrypt cracking atjaare Malvoni, Your Passwords Solar Designer, Safe: Energy-Efficient Josip Knezovic Bcrypt Cracking with Low-Cost Parallel Hardware August 19, / 21

16 Experimental Results Theoretical Peak Performance Analysis Comparison 35,000 30,000 Theoretical estimate for cost 5 (c/s) Measured performance for cost 5 (c/s) 29,179 25,000 20,000 17,989 20,538 15,000 10,000 5, ,494 11,093 7,496 4,497 4,571 4,812 4,876 6,595 1,207 Epiphany 16 Zynq 7020 Epiphany 64 Zynq 7045 i7 2600K i7 4770K KatjaAre Malvoni, Your Passwords Solar Designer, Safe: Energy-Efficient Josip Knezovic Bcrypt Cracking with Low-Cost Parallel Hardware August 19, / 21

17 Experimental Results Related work F.Wiemer, R. Zimmermann. Speed and Area-Optimized Password Search of bcrypt on FPGAs bcrypt running on ZedBoard at 80 MHz 40 parallel instances 5208 c/s at cost 5, 41.6 c/s at cost 12 Yuri Gonzaga, Google Summer of Code 2011 KatjaAre Malvoni, Your Passwords Solar Designer, Safe: Energy-Efficient Josip Knezovic Bcrypt Cracking with Low-Cost Parallel Hardware August 19, / 21

18 Future work Future work Parallella/Epiphany Using both Epiphany and Zynq 7020 at once Possible to integrate up to 64 chips on a single board Scalability of current implementation is promising 64 * 64 = 4096 cores with theoretical performance of c/s FPGA Zynq 7020 and 7045 optimizations Improve clock rate Reduce communication overhead Targeting bigger FPGAs Targeting multi-fpga boards KatjaAre Malvoni, Your Passwords Solar Designer, Safe: Energy-Efficient Josip Knezovic Bcrypt Cracking with Low-Cost Parallel Hardware August 19, / 21

19 Takeaways Takeaways Many-core low power RISC platforms and FPGAs are capable of exploiting bcrypt peculiarities to achieve comparable performance and higher energy-efficiency Higher energy-efficiency enables higher density More chips per board, more boards per system It doesn t take ASICs to improve bcrypt cracking energy-efficiency by a factor of 45+ Although ASICs would do better yet KatjaAre Malvoni, Your Passwords Solar Designer, Safe: Energy-Efficient Josip Knezovic Bcrypt Cracking with Low-Cost Parallel Hardware August 19, / 21

20 Thanks Thanks Sayantan Datta Steve Thomas Parallella project Google Summer of Code Xilinx Faculty of Electrical Engineering and Computing, University of Zagreb KatjaAre Malvoni, Your Passwords Solar Designer, Safe: Energy-Efficient Josip Knezovic Bcrypt Cracking with Low-Cost Parallel Hardware August 19, / 21

21 Questions Questions? KatjaAre Malvoni, Your Passwords Solar Designer, Safe: Energy-Efficient Josip Knezovic Bcrypt Cracking with Low-Cost Parallel Hardware August 19, / 21