MIME-Version: 1.0
Date: Tue, 7 May 2013 14:08:23 -0700
Message-ID: 
 <CAPVvHdPj5rmf294FbWi2TuEy=hSxZMNjTURESaM5zY8P_wCJMg@mail.gmail.com>
Subject: pgcrypto docs
From: Miles Elam <mileselam+postgresql@gmail.com>
To: pgsql-docs@postgresql.org
Content-Type: multipart/alternative; boundary=047d7b2e0b1bb67b2504dc27372f
Precedence: bulk
Sender: pgsql-docs-owner@postgresql.org

--047d7b2e0b1bb67b2504dc27372f
Content-Type: text/plain; charset=ISO-8859-1

Currently the docs show various stats on hashes per second and time needed
to find a particular key.  Unfortunately since the times are based upon a
Pentium 4 @1.5GHz, I worry that many would take the advice on that page at
face value, e.g., "more than 100/sec is too much while less than 4/sec is
too few," with a P4 in mind.

Using a first-generation Core i5 processor as a baseline, we're looking
roughly at about a 64x increase in processing power, not including any
dedicated crypto processing in hardware like their AES extensions.

The new table, simplistically adjusted by 64x is as follows.

Algorithm    Hashes/sec    For [a-z]    For [A-Za-z0-9]
--------------------------------------------
crypt-bf/8    1792    4 years    3927 years
crypt-bf/7    3648    2 years    1929 years
crypt-bf/6    7168    1 year     982 years
crypt-bf/5    13504  188 days    521 years
crypt-md5    171584    15 days    41 years
crypt-des    23221568    157.5 minutes    108 days
sha1    37774272    90 minutes    68 days
md5    150085504    22.5 minutes    17 days
--------------------------------------------

Perhaps with a more up to date dataset, users would be far less likely to
use far more turns of blowfish and be far more (read: appropriately) averse
to using schemes like md5.  After all, who wants to use a hash that can be
cracked on 2-year old mainstream consumer processors in less than half an
hour, let alone dedicated hardware with real money behind it.

Unfortunately I only have laptops, no desktops these days.  (A sign of the
times?)  So while I could re-run these benchmarks on a mobile i3, I don't
know if that is what is appropriate for this data table.

Anyway, food for thought.


Cheers,

Miles Elam

--047d7b2e0b1bb67b2504dc27372f
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><div><div><div><div><div><div>Currently the docs show=
 various stats on hashes per second and time needed to find a particular ke=
y.=A0 Unfortunately since the times are based upon a Pentium 4 @1.5GHz, I w=
orry that many would take the advice on that page at face value, e.g., &quo=
t;more than 100/sec is too much while less than 4/sec is too few,&quot; wit=
h a P4 in mind.<br>
<br></div>Using a first-generation Core i5 processor as a baseline, we&#39;=
re looking roughly at about a 64x increase in processing power, not includi=
ng any dedicated crypto processing in hardware like their AES extensions.<b=
r>
<br></div>The new table, simplistically adjusted by 64x is as follows.<br><=
br>Algorithm=A0=A0=A0 Hashes/sec=A0=A0=A0 For [a-z]=A0=A0=A0 For [A-Za-z0-9=
]<br>--------------------------------------------<br>crypt-bf/8=A0=A0=A0 17=
92=A0=A0=A0 4 years=A0=A0=A0 3927 years<br>
crypt-bf/7=A0=A0=A0 3648=A0=A0=A0 2 years=A0=A0=A0 1929 years<br>crypt-bf/6=
=A0=A0=A0 7168=A0=A0=A0 1 year=A0=A0=A0=A0 982 years<br>crypt-bf/5=A0=A0=A0=
 13504=A0 188 days=A0=A0=A0 521 years<br>crypt-md5=A0=A0=A0 171584=A0=A0=A0=
 15 days=A0=A0=A0 41 years<br>crypt-des=A0=A0=A0 23221568=A0=A0=A0 157.5 mi=
nutes=A0=A0=A0 108 days<br>
sha1=A0=A0=A0 37774272=A0=A0=A0 90 minutes=A0=A0=A0 68 days<br>md5=A0=A0=A0=
 150085504=A0=A0=A0 22.5 minutes=A0=A0=A0 17 days<br>----------------------=
----------------------<br><br></div>Perhaps with a more up to date dataset,=
 users would be far less likely to use far more turns of blowfish and be fa=
r more (read: appropriately) averse to using schemes like md5.=A0 After all=
, who wants to use a hash that can be cracked on 2-year old mainstream cons=
umer processors in less than half an hour, let alone dedicated hardware wit=
h real money behind it.<br>
<br></div>Unfortunately I only have laptops, no desktops these days.=A0 (A =
sign of the times?)=A0 So while I could re-run these benchmarks on a mobile=
 i3, I don&#39;t know if that is what is appropriate for this data table.<b=
r>
<br></div>Anyway, food for thought.<br><br><br></div>Cheers,<br><br></div>M=
iles Elam<br><br></div>

--047d7b2e0b1bb67b2504dc27372f--