Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror

Submission + - New John the Ripper Cracks Passwords on FPGAs

solardiz writes: John the Ripper is the oldest still evolving password cracker program (and Open Source project), first released in 1996. John the Ripper 1.9.0-jumbo-1, which has just been announced with a lengthy list of changes, is the first release to include FPGA support (in addition to CPU, GPU, and Xeon Phi). This is a long-awaited (or long-delayed) major release, encompassing 4.5 years of development and 6000+ commits by 80+ contributors. From the announcement:

"Added FPGA support for 7 hash types for ZTEX 1.15y boards [...] we support: bcrypt, descrypt (including its bigcrypt extension), sha512crypt & Drupal7, sha256crypt, md5crypt (including its Apache apr1 and AIX smd5 variations) & phpass. As far as we're aware, several of these are implemented on FPGA for the very first time. For bcrypt, our ~119k c/s at cost 5 in ~27W greatly outperforms latest high-end GPUs per board, per dollar, and per Watt. [...] We also support multi-board clusters (tested [...] for up to 16 boards, thus 64 FPGAs, [...] on a Raspberry Pi 2 host)."

Comment Re: Got my start with Terrapin Logo on an Apple ][ (Score 2) 68

Did you try the .OPTION commands that replaced the pokes?

The C64 port took a long time because of the reduced number of page zero registers available. The biggest problem was that location 0 and 1 were used for the parallel bus port, and there were lots of places where we assumed the CAR of NIL was NIL but instead it was random dat. I had a kernel ROM listing to help with the register usage, and later a 6510 Andy Finkel had fabbed for me to use with a logic analyzer to disassemble and set breakpoints on memory access for the 0 problem.

I never got the interrupts right for doing setspeed with the sprites... sorry about that.

Comment Re:Aha (Score 1) 212

The hangers are the adult stage, and if you open your closet very quickly sometimes you can catch them mating.

I told this joke in Japan once and got a polite explanation that (1) socks don't go missing because Japanese people usually hang up their laundry to dry (2) they don't keep other people's pens because they are other people's property and besides they have their own pens (3) hangers don't accumulate because they return them to the cleaners.

Comment edit articles for pay is not a sin (Score 1) 125

As long as documentation is given that somebody is paying for editing an article, and of course if the contributed text respects NPOV (and the subject is considered worth to be present in Wikipedia), there is no problem at all. After all, you may use Wikipedia articles in a commercial work: it is sufficient that it is released under CC-BY-SA. So what's bad in being paid for writing?

Comment Re:Bizarre advice (Score 1) 114

It seems to me that we are approaching a brave new time when only the skills and knowledge which are economically valuable will be taught.

This paragraph gives me the impression that you advocate educational institutions should resist giving what students and society wants out of education and instead deliver what some intellectual elite thinks is more valuable.

I read that as "we should only teach skills and knowledge that provides more monetary value for the society in the long run, compared to the resources spent on education". As a whole, I agree. However, we should improve on detecting childs clearly above average and using extra resources on them. I believe that everybody should have basic education but there's no reason to spend huge amount of education resources on everybody.

Comment Re:Short answer: I don't (Score 1) 88

I don't check (I prefer word "review" or "audit" here) the libraries for security vulnerabilities before I start using them. However, I only accept libraries than come with the source and I do cursory review of the code with a question in mind:

"Would I be willing to fix a bug in this library if the original author were not willing to fix it?"

Only if the code looks sane enough that I can answer "yes" I even start using the library. And the security is only a small part of the picture here! If the library does anything important within the product, any major bug in it's behavior will cause major issues for my product, too. If I cannot (at least in theory) fix the library, I'm not going to use it.

I might use a closed source library for some totally optional feature in the product but even in that case I'd keep looking for another solution with the source. And with "optional feature" I mean something that can be disabled or removed if any evidence comes up for the library having a security issue.

Comment Other QRSS modulation projects (Score 3, Informative) 82

This modulation scheme is called QRSS and can also be used to send very low power (milliwatt and microwatt) signals around the world ionospherically, and on bands such as VLF (very low frequency). Here the open source from a couple of projects by Hans Summers from a book I edited for the ARRL on the Arduino: http://hamradioprojects.com/authors/g0upl/+qrss-attiny/ http://hamradioprojects.com/authors/g0upl/+mm-shield/ and plenty of links about QRSS from there.

Comment Re:Smart move (Score 2) 457

Voltage? Not 5V? I took a quick look through the USB Power Delivery docs and didn't see that.
Wikipedia doesn't mention it either, though it does discuss the raising of the pre-negotiation current limit from 0.5A to 1.5A, and the max negotiated limit at 5A, which would be 25W.

http://en.wikipedia.org/wiki/USB#Power

Do you have any links on the higher voltages?

You probably already understand, but many do not, that you cannot push or provide current at 5V that the device doesn't want. If your device will draw only 500mA due to its internal design, attaching it to a 2A or 5A port won't do anything.

Comment Re:Symbolics, Lisp Machines, RMS, GNU EMACS (Score 1) 201

Carl Hewitt's "Actor" model, which is the basis for Erlang, was first implemented on multi-server systems on Symbolics Lisp Machines at the MIT-AI lab. The CADR machines could not be produced fast enough to dedicate enough to the project but when commercial ones were available Carl got a grant and bought 6 of them and they called it the Apiary. They didn't use it all the time so i thought of it mostly as a source of free machines, and we are now only just getting to the point where the multi-CPU network based shared nothing architecture begins to be a mainstream approach.

Comment Careful setting dates (Score 1) 169

In late 1999, we tested a product by rolling the date forward to 2000-01-01 and it worked fine. Then we rolled the date back to the normal date, and files that got touched during the test period caused trouble, because their modification date was "IN THE FUTURE!?!?!?" as one piece of code put it. The most broken was the timestamp data for a time-based UID generator, which flat out refused to run, saying that it was in danger of generating collisions.

Slashdot Top Deals

"A mind is a terrible thing to have leaking out your ears." -- The League of Sadistic Telepaths

Working...