Amazon EC2 Enables Cheap Brute-Force Attacks 212
snydeq writes "German white-hat hacker Thomas Roth claims he can crack WPA-PSK-protected networks in six minutes using Amazon EC2 compute power — an attack that would cost him $1.68. The key? Amazon's new cluster GPU instances. 'GPUs are (depending on the algorithm and the implementation) some hundred times faster compared to standard quad-core CPUs when it comes to brute forcing SHA-1 and MD,' Roth explained. GPU-assisted servers were previously available only in supercomputers and not to the public at large, according to Roth; that's changed with EC2. Among the questions Roth's research raises is, what role should Amazon and other public-cloud service providers play in preventing customers from using their services to commit crimes?"
20-character (Score:5, Informative)
It's actually 20 random characters that are recommended for use as cryptographic keys. The reason for this is that 20 random keys from the US keyboard has the same number of possible combinations as 128 random bits. If you use anything less than 20 random characters, even if you use a 128-bit encryption algorithm, you won't have 128-bit encryption. The same is true if you use 20 non-random characters. A brute-force attack would try passwords with words or phrases before going for the really random stuff, so you again don't have 128bit encryption.
Also fun to realize: for every character less than 20, you lose 100x your security. A 19-character password could be cracked in just 1% of the time of a 20-character password. A 10-character password would take .000000000000000001% of the time.