From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from plane.gmane.org (plane.gmane.org [80.91.229.3]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by mail.server123.net (Postfix) with ESMTPS for ; Sat, 22 Aug 2015 05:50:07 +0200 (CEST) Received: from list by plane.gmane.org with local (Exim 4.69) (envelope-from ) id 1ZSzoi-00087a-OC for dm-crypt@saout.de; Sat, 22 Aug 2015 05:50:04 +0200 Received: from HSI-KBW-149-172-137-137.hsi13.kabel-badenwuerttemberg.de ([149.172.137.137]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sat, 22 Aug 2015 05:50:04 +0200 Received: from wurzelsepp1337 by HSI-KBW-149-172-137-137.hsi13.kabel-badenwuerttemberg.de with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sat, 22 Aug 2015 05:50:04 +0200 From: Heinz Date: Sat, 22 Aug 2015 03:38:16 +0000 (UTC) Message-ID: References: <20131211180419.GA13829@tansi.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Subject: Re: [dm-crypt] question regarding Sha1 and 512 bit key xts mode List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: dm-crypt@saout.de Arno Wagner writes: > No, that is not the statement. The statement is that collision attacks > (the SHA1-weakness) are irrelevant for password hasing. Or in other words, SHA1 is secure in this case. But why not always use the best possible hash algorithm, instead of an option which is at least safe? I would logically use always the strongest one, purely as a precaution, and not what has already demonstrated weaknesses of any kind. I would not want to wait if SHA1 really holds a long time. :) > 2^160 is about 1.5*10^48. The number of atoms in this planet > is only 1.33*10^50. So if you can convert the whole planet to > storage space and can store one bit in one atom, you can just > about do it. Then there is the computing effort: Say, you get > 1M hashes/sec with 1W of power. As PBKDF2 runs with around > 100'000 iterations on average PC hardware, you then get 1 > iterated hashe for 0.1 Joule of power. That means for 2^160 > of them, you need 150*10^45 Joules. The sun has an energy > output of 3.8*10^26 W. So run the sun for 384*10^18 seconds = > 12.8*10^12 years and you have your table. > > Sounds pretty unrealistig, right? Yes, but for me a very original presentation. If i am not mistaken, a computing power of at least 10^42 FLOPS would be needed to effectively go through this area. 2^160 / 10^42 FLOPS = 1461501 Seconds = 16 Days to break SHA1, but technically we arrive until approximately 10^18 FLOPS or 1 exaFLOP. > Also note that your password is unlikely to even have 100 bits > of entropy. If you actually use a passwored with more than > 160 bits of entropy, moving to SHA-256 as hash function may > provide an irrelevant security improvement. All over 128 bits is really overkill. I once extracted my masterkey and wonder, why this consists only of numbers and the letters a-f? Why not a-z/A-Z? And special characters? Okay respect brute-force attacks is a key space of 16^128 in fact impossible, but why not exploit the maximum of what is possible? :)