Useful factoid

[Jean-David Beyer]

Robert J. Hansen wrote:
> Accurate to 6%, there are 2**25 seconds in a year.  Worth remembering:
> it makes certain kinds of computations much easier.  (It follows there
> would be about 2**35 seconds in a thousand years, or 2**45 seconds in a
> million.)
> 
> E.g., let's say you want to brute-force an 64-bit key on a CPU that can
> do a million (2**20) attempts per second.  This requires, on average,
> 2**63 attempts.  2**63 / 2**20 = 2**43 seconds: 2**43 / 2**45 = 2**-2 =
> a quarter of a million years.

Let us assume you are the bad guy and have computing power that can do
an arbitrarily large number of key attempts per second. Unless you have
my encrypted keys, you have to access my computer (unless you have
already stolen it, in which case there are much easier ways to invade
the machine), you will have to try logging in through the Internet (in
the case of my machine), and the first thing you will hit is the login
program. This can probably handle only a few attempts per second, and if
I were serious about security, I would have it double the time to reply
each time it got a failed login on that connection. In the days of
dialup, I would have the machine hang up on the connection with too many
failed login attempts.

Of course, if you could get into my machine and login as the only user
with access to my encrypted password file, you could copy that file to
your high speed facility and crack it at your leisure. But if you could
do that, you could already do anything you wanted with my machine --
install trojan horse keyloggers, defeat the security in the login
program, etc.

> 
> I don't know why it took me so long to notice that: seems like the sort
> of thing I should've noticed a decade ago.  It makes certain kinds of
> computations so much easier.
> 
> Anyway, figured I'd throw it out on the off chance there were others who
> hadn't noticed it.



-- 
  .~.  Jean-David Beyer          Registered Linux User 85642.
  /V\  PGP-Key: 9A2FC99A         Registered Machine   241939.
 /( )\ Shrewsbury, New Jersey    http://counter.li.org
 ^^-^^ 17:05:02 up 5 days, 1:38, 4 users, load average: 4.73, 4.76, 4.82