David Hulton & Dan Moniz: Faster Pwning Assured: Hardware Hacks and Cracks with FPGA's

Published: June 4, 2006, 11:10 p.m.

b'This talk will go in-depth into methods for breaking crypto faster using FPGAs. FPGA\'s are chips that have millions of gates that can be programmed and connected arbitrarily to perform any sort of task. Their inherent structure provides a perfect environment for running a variety of crypto algorithms and do so at speeds much faster than a conventional PC. A handful of new FPGA crypto projects will be presented and will demonstrate how many algorithms can be broken much faster than people really think, and in most cases, extremely inexpensively.\\n\\t\\n\\tBreaking WPA-PSK is possible with coWPAtty, but trying to do so onsite can be time consuming and boring. All that waiting around for things to be computed each and every time we want to check for dumb and default passwords. Well, we\'re impatient and like to know the password NOW! Josh Wright has recently added support for pre-computed tables to coWPAtty-but how do you create a good set of tables and not have it take 70 billion years? David Hulton has implemented the time consuming PBKDF2 step of WPA-PSK on FPGA hardware and optimized it to run at blazing speeds specifically for cracking WPA-PSK and generating tables with coWPAtty.\\n\\t\\n\\tWhat about those lusers that still use WEP? Have you only collected a few hundred interesting packets and don\'t want to wait till the universe implodes to crack your neighbor\\u2019s key? Johnycsh and David Hulton have come up with a method to offload cracking keyspaces to an FPGA and increasing the speed considerably.\\n\\t\\n\\tCheapCrack is a work in progress which follows in the footsteps of The Electronic Frontier Foundation\'s 1998 DES cracking machine, DeepCrack. In the intervening eight years since DeepCrack was designed, built, deployed, and won the RSA DES challenge, FPGAs have gotten smaller, faster, and cheaper. We wondered how feasible it would be to shrink the cost of building a DES cracking machine from $210,000 1998 dollars to around $10,000 2006 dollars, or less, using COTS FPGA hardware, tools, and HDL cores instead of custom fabricated ASICs. We\'ll show CheapCrack progress to date, and give estimates on how far from completion we are, as well as a live demo.\\n\\t\\n\\tLanman hashes have been broken for a long time and everyone knows it\'s faster to do a Rainbow table lookup than go through the whole keyspace. On many PC\'s it takes years to go through the entire typeable range, but on a small cluster of FPGAs, you can brute force that range faster than doing a Rainbow table lookup. The code for this will be briefly presented and Chipper v2.0 will be released with many new features.\\n\\t\\n\\tDavid Hulton and Dan Moniz will also discuss some of the aspects of algorithms that make them suitable for acceleration on FPGAs and the reasons why they run faster in hardware."'