July 22, 2003

Cracking Windows Passwords in 5 seconds

Over lunch I read a pretty interesting paper on "Making a Faster Cryptanalytic Time-Memory Trade-Off". In around 1980 Martin Hellman described a cryptanalytic time-memory trade-off which reduces the time of cryptanalysis by using precalculated data stored in memory. This was improved upon by Rivest sometime in 1982, and the researcher believes no work since then has been done to optomize it.

The paper proposed that by precalculating the data it can significantly speed up the cryptoanalysis process. The researchers have implemented an attack on MS-Windows password hashes. Using 1.4GB of data (two CD-ROMs) they can crack 99.9% of all alphanumerical passwords hashes (2^37) in 13.6 seconds which is quite impressive. The next closest thing takes
101 seconds with the current approach using distinguished points. L0phtcrack takes even longer most times.

It's a good read. It will be interesting to see how other cryptanalysts will respond to this paper. If you got some time, go read the paper.

If you want to see it in action check out some of their online research and demo here.

Posted by SilverStr at July 22, 2003 02:46 PM