Hacker News new | ask | show | jobs
by BjoernKW 1394 days ago
To offer a slightly more accurate measure than "half a jiffy", this article (published on May 9, 2022) lists the costs involved for different types of passwords and password lengths:

https://support.1password.com/pbkdf2/

Clocking in at a cracking cost of 79 million USD, for most intents and purposes, even a rather trivial 56-bit entropy password such as "align-caught-boycott-delete" (or "correct horse battery staple", for that matter) would be prohibitively expensive to break.

1 comments

In the case of PBKDF2 it hinges on what PRF and how many rounds. As an example, WPA2 uses PBKDF2 with an HMAC and accompanying parameters to the tune of a single upper-tier consumer GPU being able to test just over a million passwords per second through hashcat. Realistically you will find the password long before you're close to the end of the key space.