From f752214db776a52a0e6ba635c7c50d869807fafb Mon Sep 17 00:00:00 2001 From: Daniel Gustafsson Date: Tue, 5 Mar 2024 11:28:31 +0100 Subject: [PATCH v3 1/2] pgcrypto: Remove hash speed comparison table The table comparing relative hash speed is at best misleading, and at worst misinforming. The benchmarks are old and do not reflect the current state of the art. The table also imply security due to brute-force protection, which is no longer true for many algorithms which have published vulnerabilities which avoid the need for brute force. --- doc/src/sgml/pgcrypto.sgml | 134 ------------------------------------- 1 file changed, 134 deletions(-) diff --git a/doc/src/sgml/pgcrypto.sgml b/doc/src/sgml/pgcrypto.sgml index 2db159be71..e66d60878f 100644 --- a/doc/src/sgml/pgcrypto.sgml +++ b/doc/src/sgml/pgcrypto.sgml @@ -300,140 +300,6 @@ gen_salt(type text [, iter_count integer ]) returns text Slower than 4 hashes per second would probably dampen usability. Faster than 100 hashes per second is probably too fast. - - - gives an overview of the relative slowness - of different hashing algorithms. - The table shows how much time it would take to try all - combinations of characters in an 8-character password, assuming - that the password contains either only lower case letters, or - upper- and lower-case letters and numbers. - In the crypt-bf entries, the number after a slash is - the iter_count parameter of - gen_salt. - - - - Hash Algorithm Speeds - - - - Algorithm - Hashes/sec - For [a-z] - For [A-Za-z0-9] - Duration relative to md5 hash - - - - - crypt-bf/8 - 1792 - 4 years - 3927 years - 100k - - - crypt-bf/7 - 3648 - 2 years - 1929 years - 50k - - - crypt-bf/6 - 7168 - 1 year - 982 years - 25k - - - crypt-bf/5 - 13504 - 188 days - 521 years - 12.5k - - - crypt-md5 - 171584 - 15 days - 41 years - 1k - - - crypt-des - 23221568 - 157.5 minutes - 108 days - 7 - - - sha1 - 37774272 - 90 minutes - 68 days - 4 - - - md5 (hash) - 150085504 - 22.5 minutes - 17 days - 1 - - - -
- - - Notes: - - - - - - The machine used is an Intel Mobile Core i3. - - - - - crypt-des and crypt-md5 algorithm numbers are - taken from John the Ripper v1.6.38 -test output. - - - - - md5 hash numbers are from mdcrack 1.2. - - - - - sha1 numbers are from lcrack-20031130-beta. - - - - - crypt-bf numbers are taken using a simple program that - loops over 1000 8-character passwords. That way the speed - with different numbers of iterations can be shown. For reference: john - -test shows 13506 loops/sec for crypt-bf/5. - (The very small - difference in results is in accordance with the fact that the - crypt-bf implementation in pgcrypto - is the same one used in John the Ripper.) - - - - - - Note that try all combinations is not a realistic exercise. - Usually password cracking is done with the help of dictionaries, which - contain both regular words and various mutations of them. So, even - somewhat word-like passwords could be cracked much faster than the above - numbers suggest, while a 6-character non-word-like password may escape - cracking. Or not. - -- 2.32.1 (Apple Git-133)