RACF KDFAES Implementation

[prev in list] [next in list] [prev in thread] [next in thread]

List:       racf-l
Subject:    Re: Statistics on KDFAES
From:       Costin Enache <00000252c7734702-dmarc-request () LISTSERV ! UGA ! EDU>
Date:       2018-11-23 17:28:38
Message-ID: 1151329622.5148586.1542994118617 () mail ! yahoo ! com
[Download message RAW]

Stu, we have implemented KDFAES on GPU for our password analytics solution \
(shameless: EPAS), and I would say it is a fairly secure hashing scheme. I can \
provide the detailed algorithm upon request, but for your question I guess details \
below are enough:

The input for key derivation is:
- for passwords,  the original DES (the pre-KDFAES) hash is calculated first; this \
                permits one-way migration of old hashes
- for password phrases, the input phrase is hashed with SHA256; this means no \
migration for password phrases

The key derivation is using PBKDF2-SHA256, slightly modified. Two sets are done, each \
8 * 5000 rounds, plus an extra set of 5000. In total there are 9 PBKDF2-SHA256, each \
with 5000 rounds, giving 85000 rounds. This is a lot. Of MIPS too :)

The key obtained is used to encrypt the username with AES, giving the final KDFAES \
hash. Cracking this type of hash is not something easily done. The key derivation is \
the time consuming part, the final AES is quite fast.

Some numbers for hash probing, all are using GPU acceleration with OpenCL, with \
1xNvidia 1080 TI, based on hashcat: Original DES: 3909.8 MH/s (3937402282 hashes / \
                second)
KDFAES: 29 kH/s (29943 hashes/second)
Our fastest experimental implementation does 690 kH/s (690223 hashes/second), and \
uses 10x Nvidia 2080 GPUs. This is still very slow and cannot be used alone to \
recover passwords.

Considering that KDFAES (as well as DES) RACF hashes are salted, the numbers above \
apply for each account. So if cracking a decent KDFAES hashed password takes 1 year, \
30000 passwords would take 30000 years.

Cheers,
Costin





    On Friday, 26 October 2018, 20:45:15 CEST, Stu Henderson <stu@STUHENDERSON.COM> \
wrote:
 List, I'm hoping someone can provide actual numbers describing the
advantage of KDFAES over plain old AES (used by some other products).Â
For example, imagine a RACF database with say 30,000 users, all with
their passwords encrypted with  KDFAES.  And a hacker gets a copy of
this RACF database and runs one of the free password cracker programs.Â
(Imagine that John the Ripper is updated for KDFAES if it hasn't been
already.).  Roughly how long would it take to learn all the userids and
passwords?  Would it take weeks or months or years?  Would it take
longer than the password change interval of say, 30 days?

And how would this compare to a security software database that
encrypted the passwords with ordinary AES, not with KDFAES?  How much
longer would the hacker have to run the cracker program with KDFAES?

I'd be grateful for any sound theoretical answers, and more so for
actual test results.  Thanks in advance.  Stu


--
Next mainframe audit seminar November 5-8, 2018 in Bethesda Md; Next
RACF Administration seminar November 27-30 phone (301) 229-7187



[prev in list] [next in list] [prev in thread] [next in thread]

Configure | About | News | Add a list | Sponsored by KoreLogic