A Quarter of a Second, Ten Thousand Times at Once
Last timeMaking It Deliberately Slow
A repetition count costs processor time, and processor time is the one thing an attacker can buy in bulk. The answer is to demand something their hardware has little of: memory.
They do not go faster, they go wider
The previous lesson left us with a quarter of a second per computation,
which sounded like four guesses a second. That figure contains an
assumption nobody stated: one computation at a time.
An attacker has no reason to honour it. They do not need to make one
computation faster, and against a well-designed function they cannot.
They run many at once, and the hardware for running many simple
computations at once is a graphics card, which is a device with thousands
of small cores, sold at a consumer price, rentable by the hour.
So a repetition count that takes a quarter of a second on one core takes a
quarter of a second on each of ten thousand cores, simultaneously. The
attacker's rate is not four a second. It is forty thousand a second, from
one card, and the cost per guess fell by four orders of magnitude without
anybody breaking anything.
| copies, cost in time onl | copies achieved, cost in | copies, cost in time and | copies achieved, cost in | |
|---|---|---|---|---|
| one ordinary processor c | 1 | 1 | 1 | 1 |
| a rented graphics card | 1 | 2000 | 1 | 20 |
| several cards in one mac | 1 | 10000 | 1 | 60 |
| purpose-built hardware | 1 | 100000 | 1 | 200 |
This is the point at which the previous lesson stops being enough, and it
is worth being clear that it is not wrong. The per-account cost is still
real, the per-user value is still essential, and the measured quarter of a
second still applies. What has happened is that the attacker found the one
resource that is cheap to multiply.
Why memory is not buyable in bulk
Why does memory behave differently? Because of what the hardware looks
like physically.
A card achieves its parallelism by having thousands of very simple cores
sharing a comparatively small pool of fast memory. Ten thousand cores and
sixteen thousand megabytes of memory sounds like plenty until you divide:
that is under two megabytes a core, and the fast local memory each core
can reach without contention is measured in tens of kilobytes.
Cores are cheap to add because they are small and simple. Memory is not,
because it occupies area, it draws power, and the paths to it are the part
of the design that is hard. So demanding memory per computation attacks
the attacker's advantage at its root rather than at its surface.
The lesson stops here
5 more paragraphs to go
You have read the opening. The rest of the argument, the problems that check whether it landed, and the lines worth keeping at the end all come with a plan.
The first lesson of every course in the library reads the whole way through, free, so you can see exactly what the rest of them are.
See the planThe contentsThis is the reading half
Starting the course gives you your own copy of it. Every idea on every page has problems standing under it, marked with a reason rather than a tick, and any sentence you do not believe can be opened and argued with. None of that can happen on a page nobody owns.
The contents