bcrypt 如何跟上摩尔定律？
我一直看到使用 bcrypt 来哈希密码的建议，因为它能够符合摩尔定律。
显然，这是因为攻击者破解 bcrypt 哈希所需的时间比 SHA256 等通用哈希函数生成的哈希要长得多。
这怎么可能？尽管有摩尔定律，算法怎么能故意变慢呢？
I have been seeing recommendations to use bcrypt to hash passwords because of its ability to keep up with Moore's Law.
Apparently the reason for this is because it would take much longer for an attacker to crack a bcrypt hash than a hash generated by a general purpose hash function like SHA256.
How is that possible? How can an algorithm be deliberately slow in spite of Moore's law?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
bcrypt 可使用名为“工作系数”的参数进行配置。在内部，它将连续多次执行类似于散列的操作。 “多”是可以配置的部分，最多可达数十亿。因此，为了应对摩尔定律，只需调高该设置即可。另一个可以根据需要变慢的函数是 PBKDF2 （请参阅“迭代计数”参数）。
请注意，使密码散列变慢的目的是让攻击者变得困难，但它也会机械地使“诚实系统”的事情变慢；这是一个权衡。请参阅此答案（有关更多详细信息，请参阅 security.stackexchange。
bcrypt is configurable with a parameter called "work factor". Internally, it will perform an operation which is similar to hashing, many times successively. The "many" is the part that can be configured, up to several billions. So, to cope with Moore's law, just crank up that setting. Another function which can be made as slow as wanted is PBKDF2 (see the "iteration count" parameter).
Note that the point of making the password hashing slow is to make things difficult for the attacker, but it also mechanically makes things slow for the "honest systems" too; that's a trade-off. See this answer (on security.stackexchange) for more details.
攻击者会想要尝试所有 216,553 个英文单词。
再加上 常见变体 的另外 12 位努力，可以说给出了 887,001,088 的列表（229) 可能的密码。
BCrypt 大约需要 4,342,912 （即 222) 计算一个哈希值的操作（成本=12）。
目前的核心可提供大约 231 周期/秒；最先进的技术是每个处理器 8 = 23 个核心，总共 23 * 231 = 234 周期/秒。服务器通常有 4 个处理器，将总数增加到 22 * 234 = 236 周期/秒。
222 周期计算一个哈希 * 229 个可能的（常见）密码 = 251 周期运行所有（常见）密码。
这意味着 4 处理器、八核服务器大约需要 251 / 236 = 215 秒（9 小时） ）来运行所有常用密码。
实际上我的密码并不常见，大约使用 44 位。 244 个密码 * 每个密码 222 次循环 = 266 次循环尝试所有不常见的密码。 266 / 236 周期/秒 = 230 秒（34 年）才能找到我的密码。
摩尔定律指出，处理能力每 18 个月就会翻一番。
现在，bcrypt 符合摩尔定律。
将成本系数从12增加到13，这将使所涉及的时间加倍。
An attacker will want to try all 216,553 english words.
Plus another 12 bits of effort for the common variations, which lets say gives a list of 887,001,088 (229) possible passwords.
BCrypt takes about 4,342,912 (i.e. 222) operations to calculate one hash (at cost=12).
A core today provides about 231 cycles/sec; the state of the art is 8 = 23 cores per processor for a total of 23 * 231 = 234 cycles/sec. A server typically has 4 processors, increasing the total to 22 * 234 = 236 cycles/sec.
222 cycles to calculate one hash * 229 possible (common) passwords = 251 cycles to run through all (common) passwords.
This means that it would take a 4-processor, octo-core, server about 251 / 236 = 215 seconds (9 hours) to run through all common passwords.
In reality my password is not common, and uses about 44-bits. 244 passwords * 222 cycles per password = 266 cycles to try all uncommon passwords. 266 / 236 cycles/second = 230 seconds (34 years) to find my password.
Moore's Law's says the processing power doubles every 18 months.
That's now bcrypt holds up against Moore's Law.
Increase the cost factor from 12 to 13 and that will double the times involved.