1
00:00:08,870 --> 00:00:10,290
Thank you very much.

2
00:00:10,950 --> 00:00:14,230
I guess that's a pretty good reason not to go to TorCon, but...

3
00:00:26,200 --> 00:00:32,140
Okay, so quite a lot of people were over in the other room for my other presentation, right?

4
00:00:32,140 --> 00:00:32,580
Yeah?

5
00:00:33,020 --> 00:00:33,960
Okay, cool.

6
00:00:35,260 --> 00:00:36,940
So yeah, this is my presentation.

7
00:00:37,880 --> 00:00:45,820
A little background about everything that happened with other thing was I checked on the DEF CON website like last week to see when I was speaking.

8
00:00:46,040 --> 00:00:51,920
And as you can see on the slide over there, like going along the left-hand side, it says July 30th.

9
00:00:52,500 --> 00:00:58,320
And that's when I thought that I was going to speak, but I guess they moved me to July 29th or something like that.

10
00:00:58,740 --> 00:01:04,980
And so I thought I was speaking tomorrow and I thought that I had an extra 24 hours to prepare everything, but I didn't.

11
00:01:04,980 --> 00:01:12,980
And so in the middle of coding all this stuff together, I got a call from one of our friends saying that I was supposed to be speaking right then, earlier today.

12
00:01:13,240 --> 00:01:21,260
And we were over at Caesars Palace, kind of far away, and I don't know if you saw this big box over here, but it weighs about 100 pounds and it carries all this crap.

13
00:01:21,700 --> 00:01:29,260
So it was a little difficult to get over here, and then once we got over here, they just decided to put some other people on and move me somewhere else.

14
00:01:29,300 --> 00:01:30,820
But this is my talk.

15
00:01:30,820 --> 00:01:34,840
I'm sorry that I didn't show up for the other one, if you guys waited in line or anything like that.

16
00:01:35,800 --> 00:01:38,640
If you did wait in line and you're angry at me, go and have some more beer.

17
00:01:38,640 --> 00:01:39,920
I think we have some more left here.

18
00:01:43,020 --> 00:01:45,220
You have to fight George first, I think.

19
00:01:51,560 --> 00:01:55,900
Okay, so if you want to fight George, feel free to.

20
00:01:55,900 --> 00:01:57,200
The winner gets free beer.

21
00:01:59,620 --> 00:02:01,400
Okay, so this is my talk.

22
00:02:01,400 --> 00:02:07,320
I'm going to be talking about basically cracking crypto on FPGAs and some different things that people are doing.

23
00:02:11,560 --> 00:02:16,640
And just if you don't know anything about me, I started this thing called DocBodenLabs.

24
00:02:16,640 --> 00:02:17,640
We made BSDR tools.

25
00:02:17,640 --> 00:02:19,740
I did some smart card hacking stuff a while back.

26
00:02:20,540 --> 00:02:21,580
I run TorCon.

27
00:02:21,780 --> 00:02:23,200
George helps out with TorCon.

28
00:02:23,200 --> 00:02:25,400
There's a bunch of other people here that help out with TorCon, too.

29
00:02:25,400 --> 00:02:26,340
But it's in San Diego.

30
00:02:26,340 --> 00:02:27,660
He already told you the info.

31
00:02:29,880 --> 00:02:32,160
I'm starting this company called Pico Computing.

32
00:02:32,160 --> 00:02:34,660
We've got our huge logo on the side of this thing.

33
00:02:34,660 --> 00:02:37,580
We make FPGA cards that are really expensive.

34
00:02:40,520 --> 00:02:43,120
If you have a lot of money, please buy our cards.

35
00:02:43,120 --> 00:02:44,840
If you don't, then buy somebody else's.

36
00:02:46,660 --> 00:02:47,780
Our disclaimer.

37
00:02:48,460 --> 00:02:49,820
Educational purposes only.

38
00:02:49,820 --> 00:02:51,500
All that crap.

39
00:02:53,220 --> 00:02:56,880
I'm going to be covering an introduction to FPGAs.

40
00:02:56,880 --> 00:02:59,400
First of all, who here knows what an FPGA is?

41
00:03:00,140 --> 00:03:00,960
Oh, wow.

42
00:03:01,060 --> 00:03:02,020
Awesome.

43
00:03:02,100 --> 00:03:04,480
I can just fast-forward through that, then.

44
00:03:04,680 --> 00:03:06,480
Some GateLogic crap.

45
00:03:06,840 --> 00:03:08,080
Cracking with hardware.

46
00:03:08,220 --> 00:03:14,060
I'm just going to cover some of the stuff that other people have done in regards to cracking stuff on FPGAs.

47
00:03:14,320 --> 00:03:19,200
Cover some optimizations that you can use to speed up your code and hardware.

48
00:03:19,200 --> 00:03:25,440
And introduce this program called Chipper, which we just named a couple days ago and just started coding a couple days ago.

49
00:03:25,920 --> 00:03:29,540
It does Landman and NTLM cracking for Windows.

50
00:03:29,540 --> 00:03:32,060
It does it about 100 times faster than a PC.

51
00:03:32,060 --> 00:03:35,940
On one of our tiny little cards that's a compact flash card size.

52
00:03:37,180 --> 00:03:43,740
I have to safely remove this thing.

53
00:03:44,120 --> 00:03:47,640
Otherwise, our driver stops working.

54
00:03:47,640 --> 00:03:48,980
There's some bugs in it.

55
00:03:58,610 --> 00:04:00,030
PCMCIA card.

56
00:04:00,430 --> 00:04:02,750
This is our card that we make.

57
00:04:02,750 --> 00:04:07,030
It's got a FPGA on it that cracks stuff 100 times faster than a PC.

58
00:04:08,170 --> 00:04:10,410
It's just a compact flash card.

59
00:04:10,830 --> 00:04:12,850
I'll cover more of the details later.

60
00:04:13,590 --> 00:04:19,270
I'll give a demo of what this box does and give you some performance information.

61
00:04:20,470 --> 00:04:24,090
First of all, an FPGA lets you prototype integrated circuits.

62
00:04:24,870 --> 00:04:26,390
Basically, you write code.

63
00:04:26,390 --> 00:04:30,770
It translates directly into gate logic and stuff that runs on the FPGA.

64
00:04:33,290 --> 00:04:40,950
There's the basic logic, boolean sort of stuff that you can do with gates and stuff.

65
00:04:43,350 --> 00:04:49,550
You can implement adders and all sorts of other more complex gates using just really simple basic components.

66
00:04:50,970 --> 00:04:53,450
You can chain them together and do all sorts of crazy stuff.

67
00:04:53,450 --> 00:05:01,690
That's basically what electronics is based off of, just using small little bitwise operations and chaining them together to do more complex stuff.

68
00:05:02,750 --> 00:05:07,290
You can also use gates to store values if you want to make memory.

69
00:05:07,290 --> 00:05:11,290
Most flash memory is based off of a bunch of gates that just store values.

70
00:05:15,070 --> 00:05:18,190
They can be implemented with electronics pretty simply.

71
00:05:21,730 --> 00:05:22,830
Let's see here.

72
00:05:23,490 --> 00:05:25,350
Gates can be configured arbitrarily.

73
00:05:25,390 --> 00:05:26,890
You just have a bunch of different gates on there.

74
00:05:26,890 --> 00:05:29,890
You can say, I want to connect this one with this one.

75
00:05:29,890 --> 00:05:32,950
I want to connect this to this other component that I have.

76
00:05:33,430 --> 00:05:43,990
Instead of designing your whole thing and burning it to a chip or having a bunch of small little gates that you connect together with wires, it basically connects all the wires for you and has some basic components that you can use.

77
00:05:44,590 --> 00:05:47,530
With an FPGA, you can create almost any type of logic.

78
00:05:47,530 --> 00:05:50,530
You're just bound by the size of the device.

79
00:05:52,130 --> 00:05:54,170
An FPGA just looks kind of like this.

80
00:05:54,170 --> 00:05:59,030
You have a bunch of CLBs that have registers and basic logic routing stuff.

81
00:05:59,390 --> 00:06:06,530
Those are those little... I'm not sure if you can see it, but the red areas are composed of a bunch of little small cells.

82
00:06:07,110 --> 00:06:11,970
Then there's input-output blocks, block RAM, digital clock managers.

83
00:06:11,970 --> 00:06:19,210
You can also get FPGAs with built-in power PCs or built-in processors if you want to actually have a real processor.

84
00:06:20,750 --> 00:06:24,090
There's a programmable routing matrix that allows you to connect everything together.

85
00:06:25,770 --> 00:06:30,630
The pros of using hardware is you can do massively parallel stuff.

86
00:06:30,630 --> 00:06:33,530
You have a bunch of gates that are pretty much active all the time.

87
00:06:33,530 --> 00:06:37,250
You don't have to worry about just running one instruction at a time.

88
00:06:37,250 --> 00:06:39,130
You can have a bunch of things running at the same time.

89
00:06:39,130 --> 00:06:42,990
And you can pipeline stuff, which is basically kind of the same thing as parallelizing.

90
00:06:46,290 --> 00:06:52,470
The other nice thing about FPGAs is that with an ASIC, you just burn all the gates to a chip and you're done with it.

91
00:06:52,470 --> 00:06:55,190
With an FPGA, you can reconfigure it a bunch of times.

92
00:06:55,510 --> 00:06:57,030
It makes it easy to prototype stuff.

93
00:06:57,030 --> 00:07:00,030
You can also have them reconfigure themselves and things like that.

94
00:07:00,910 --> 00:07:04,710
The cons are that you have size constraints and limitations.

95
00:07:05,250 --> 00:07:08,710
It's a little more difficult to code and debug than with software.

96
00:07:11,670 --> 00:07:14,910
There's some common applications for FPGAs.

97
00:07:15,670 --> 00:07:18,690
I'm just going to be focusing on encryption and decryption.

98
00:07:20,390 --> 00:07:22,290
Different types of FPGAs.

99
00:07:22,310 --> 00:07:28,730
There's anti-fuse ones where you just tell it how the gates should be configured and it just stays that way forever.

100
00:07:28,730 --> 00:07:30,210
You can't reprogram them.

101
00:07:30,210 --> 00:07:35,370
There's flash ones, which you can program and they'll keep their state even when you power them off and stuff.

102
00:07:35,690 --> 00:07:39,270
And then there's SRAM ones where you have to configure them every time they start up.

103
00:07:39,270 --> 00:07:44,650
So you basically have a port and you feed a bunch of configuration stuff into it and it configures itself that way.

104
00:07:45,590 --> 00:07:47,330
SRAM is the most common technology.

105
00:07:47,330 --> 00:07:49,350
It scales better for the larger FPGAs.

106
00:07:49,430 --> 00:07:51,410
The only problem is that it requires a loader.

107
00:07:55,010 --> 00:07:57,790
There's a few different FPGA manufacturers.

108
00:07:57,970 --> 00:07:59,570
We use Xilinx FPGAs.

109
00:07:59,570 --> 00:08:03,190
There's also Altera, which I think is a lot bigger with academic places.

110
00:08:03,190 --> 00:08:05,530
Does anybody here use Xilinx or Altera?

111
00:08:05,530 --> 00:08:06,210
Xilinx?

112
00:08:06,210 --> 00:08:06,930
Anybody?

113
00:08:07,070 --> 00:08:07,990
Xilinx?

114
00:08:08,330 --> 00:08:09,050
Altera?

115
00:08:09,050 --> 00:08:09,730
Anybody?

116
00:08:10,250 --> 00:08:11,030
One?

117
00:08:11,690 --> 00:08:12,690
Two?

118
00:08:12,690 --> 00:08:13,410
Okay.

119
00:08:13,610 --> 00:08:17,310
The main difference is they kind of have the same sort of chips.

120
00:08:17,310 --> 00:08:21,810
Xilinx is a lot bigger company and a lot more commercial.

121
00:08:21,810 --> 00:08:31,930
And you can also get them with an optional power PC that will actually run up to like 300-400 MHz as opposed to like a soft core which only goes to like 1 or 150 or something like that.

122
00:08:34,450 --> 00:08:36,310
So how do you program these things?

123
00:08:36,310 --> 00:08:38,710
There's a programming language called Verilog.

124
00:08:38,710 --> 00:08:42,210
You can also use VHDL, but most of my stuff is in Verilog.

125
00:08:42,310 --> 00:08:46,270
And it has a simple C-like syntax and it's really simple.

126
00:08:47,390 --> 00:08:49,710
It's really easy to learn but difficult to master.

127
00:08:52,330 --> 00:08:55,870
So a basic code comparison between the two.

128
00:08:55,870 --> 00:09:01,030
This is kind of stupid, but if you want to do an OR with C, then you just kind of...

129
00:09:01,030 --> 00:09:02,490
or an AND, sorry.

130
00:09:02,690 --> 00:09:07,270
And then with Verilog, it's kind of the same thing where you assign and...

131
00:09:07,270 --> 00:09:07,810
I don't know.

132
00:09:08,630 --> 00:09:09,790
Hey, stop laughing.

133
00:09:12,620 --> 00:09:15,440
And so if you want to do like an 8-bit AND, then it's kind of the same thing.

134
00:09:15,440 --> 00:09:21,260
You can have data buses in Verilog where you can specify how many bits you want the variable to be and then just do operations on them.

135
00:09:22,620 --> 00:09:26,880
And you aren't limited by like 8 bits or 16 bits or 32 bits or whatever.

136
00:09:27,980 --> 00:09:29,260
And then you can...

137
00:09:29,820 --> 00:09:33,260
then you basically just have flip-flops for storage if you want to save state or...

138
00:09:34,120 --> 00:09:38,440
or basically have something that gets configured a certain way and then...

139
00:09:38,440 --> 00:09:42,300
you know, in every sort of trigger, you can create a flip-flop.

140
00:09:43,440 --> 00:09:48,600
And that's really all you have is wires and flip-flops and other sorts of components that are actually on the device.

141
00:09:48,600 --> 00:09:50,480
And you can do a lot with just that.

142
00:09:52,260 --> 00:09:56,520
So I'm going to cover the history of FPGAs and cryptography.

143
00:09:56,640 --> 00:10:03,940
Just to start this out, there are a bunch of these guys that wrote this paper a while back on minimal key lengths and symmetric ciphers.

144
00:10:03,940 --> 00:10:08,120
There's Shimomura on there, there's Rivest, Schneier, all those people.

145
00:10:08,300 --> 00:10:24,340
And they did some research to try and figure out like the best key lengths that people should be using that would protect you against the common attacker, like a kid in his basement, major corporations, or NSA.

146
00:10:25,180 --> 00:10:29,220
And so this is basically what they came to the conclusion of.

147
00:10:30,060 --> 00:10:43,020
Basically, a kid in his basement could take a tiny FPGA, $400, and crack 40 bits in about 5 hours, or 56 bits in 38 years.

148
00:10:43,020 --> 00:10:48,140
And then at the very bottom you have an intelligence agency with a budget of about $300 million.

149
00:10:48,460 --> 00:10:53,320
And they can crack 40 bits in pretty much real time, and 56 bits in 12 seconds.

150
00:10:53,580 --> 00:10:56,600
And this is what they found with their research.

151
00:10:58,020 --> 00:11:00,120
And this was published in 1996.

152
00:11:02,240 --> 00:11:09,640
So it's kind of scary that most likely the government can crack 56-bit encryption, blah blah blah.

153
00:11:09,640 --> 00:11:15,420
But everybody's using 128, you know, 256, and that's like way much more difficult than this.

154
00:11:15,460 --> 00:11:18,460
So it's not saying much, but it's still a little bit scary.

155
00:11:20,860 --> 00:11:31,580
So the EFF in 1998 built a desk cracker that could crack, well it ended up cracking desks in 3 days, and it ended up winning like the RC4 challenge or whatever.

156
00:11:31,580 --> 00:11:34,400
Or the, sorry, the Desk Distributed On-Net Challenge.

157
00:11:34,400 --> 00:11:38,280
And they claimed that they did about 9 billion keys per second.

158
00:11:38,280 --> 00:11:39,480
They could search.

159
00:11:40,040 --> 00:11:44,740
And it cost them a little less than $250,000, including engineering and all that stuff.

160
00:11:45,720 --> 00:11:46,960
Has anybody heard of that?

161
00:11:46,960 --> 00:11:48,440
EFF Desk Cracker?

162
00:11:52,320 --> 00:11:57,880
There's these other guys that hacked ATM machines using an FPGA, just because they needed to crack it a little bit faster.

163
00:11:59,800 --> 00:12:01,800
These guys are really interesting.

164
00:12:01,800 --> 00:12:06,720
They actually implemented a linear cryptanalysis attack on desks using FPGAs.

165
00:12:06,720 --> 00:12:11,120
Basically you need to compute a big dictionary and then do lookups.

166
00:12:12,800 --> 00:12:16,780
It's a chosen plain text attack, so it isn't really that crazy.

167
00:12:16,780 --> 00:12:22,140
I mean, if you had some sort of device and you were trying to figure out the key in it, then you could do this sort of attack.

168
00:12:22,140 --> 00:12:26,520
But if you're just trying to decrypt a document, it's not going to help you that much.

169
00:12:28,620 --> 00:12:37,060
They were able to recover a key in 10 seconds with a 72% success rate, as opposed to about 5 months, I think, or 5 years, a really long time.

170
00:12:39,500 --> 00:12:44,580
There's a bunch of other people implementing stuff and cracking RC4 and all sorts of crazy stuff.

171
00:12:45,220 --> 00:12:48,020
There's quite a few people out there that are doing this stuff.

172
00:12:50,540 --> 00:13:01,340
Basically, the way that you can exploit FPGAs to get really crazy performance out of them is on a PC, you do a simple for loop or something like that.

173
00:13:01,340 --> 00:13:03,280
It takes a certain amount of time.

174
00:13:03,280 --> 00:13:04,360
You have to do it sequentially.

175
00:13:08,180 --> 00:13:10,580
Basically, in hardware, you can do it all in parallel.

176
00:13:11,100 --> 00:13:16,720
Instead of having a for loop where you have to go through each iteration and compute whatever, you can do it all in parallel.

177
00:13:21,260 --> 00:13:23,420
Okay, just use your imaginations.

178
00:13:28,980 --> 00:13:30,400
Then there's a pipeline example.

179
00:13:30,400 --> 00:13:32,920
There is a pipeline there, you just can't see it.

180
00:13:33,420 --> 00:13:34,840
It's down there.

181
00:13:36,220 --> 00:13:40,860
Basically, if you're trying to perform a bunch of different operations, you can have...

182
00:13:42,360 --> 00:13:43,960
Okay, that kind of sucks.

183
00:13:45,820 --> 00:13:55,740
Basically, you have information that flows in on one end, and you have a register that stores a value for that state where it's some value plus one.

184
00:13:55,740 --> 00:14:02,660
If you need to subtract another number from it, then you do the subtraction stage in the next stage.

185
00:14:03,240 --> 00:14:06,560
Then this has that value plus one minus whatever.

186
00:14:06,680 --> 00:14:09,340
Then over here, you have the next value that's fed in.

187
00:14:09,340 --> 00:14:15,400
You can basically have all these parallel operations going while you're performing elements sequentially.

188
00:14:17,460 --> 00:14:26,500
Essentially, the speed of the whole pipeline is equivalent to the fastest or slowest operation in the pipeline.

189
00:14:27,340 --> 00:14:34,700
If your addition somewhere is the slowest thing, that's as slow as the pipeline is going to be, plus how many clock cycles it takes to go through the whole thing.

190
00:14:37,720 --> 00:14:40,040
That's a really common way of optimizing things.

191
00:14:40,040 --> 00:14:41,940
It's basically just parallelizing things.

192
00:14:43,740 --> 00:14:49,580
Another nice thing is with self-reconfiguration, you get an advantage over ASICs.

193
00:14:54,340 --> 00:15:00,900
Essentially, if you need to multiply some arrays, you can load on a core that multiplies arrays.

194
00:15:01,040 --> 00:15:08,280
Then you can switch it out with your RC4 core and RC4 it, and then switch it out with MD5 and MD5 it.

195
00:15:08,540 --> 00:15:11,620
You don't have to have three different chips or one huge chip.

196
00:15:11,620 --> 00:15:15,420
You can just reconfigure it with specific parts of whatever you need to do.

197
00:15:18,400 --> 00:15:21,820
There are some special components that you can use with Vertex 4s.

198
00:15:21,820 --> 00:15:24,320
Anybody heard of the DSP48 slice?

199
00:15:25,860 --> 00:15:28,300
It's a new thing with the Vertex 4s.

200
00:15:31,460 --> 00:15:36,980
You can do 18x18 multipliers, 48x48 bit adders.

201
00:15:37,920 --> 00:15:41,600
It does 18x18 multipliers at 500 MHz, which is pretty decent.

202
00:15:42,160 --> 00:15:51,880
It's not that great compared to a PC, but you have 48 of them, so you can do 48 18x18 multipliers in parallel at 500 MHz.

203
00:15:51,880 --> 00:15:52,980
That's pretty decent.

204
00:15:54,180 --> 00:15:56,600
There's also block RAM that you can use for storage.

205
00:15:56,700 --> 00:15:57,680
They're pretty fast.

206
00:15:57,680 --> 00:15:58,740
They have FIFO support.

207
00:15:58,740 --> 00:16:01,260
If you just need a FIFO, it's all built in.

208
00:16:01,440 --> 00:16:04,300
They have these sort of components that people commonly use.

209
00:16:04,300 --> 00:16:06,540
They commonly use FIFOs, adders, and multipliers.

210
00:16:06,540 --> 00:16:13,180
They just build them in as hard components, so you can utilize them and they're extremely optimized for whatever they need to do.

211
00:16:14,660 --> 00:16:20,560
Another really interesting thing is that if you get a Vertex 4 with a PowerPC, they have this new thing called the APU.

212
00:16:21,200 --> 00:16:30,600
Basically, you can create your own instructions on the PowerPC and have it execute your Verilog code or your hardware code.

213
00:16:30,600 --> 00:16:34,280
You can essentially make a DES instruction.

214
00:16:34,420 --> 00:16:37,660
You just run this instruction and it runs DES on whatever it needs.

215
00:16:39,340 --> 00:16:41,620
There's lots of really cool things you can do with it.

216
00:16:41,740 --> 00:16:52,880
Basically, your code has access to all the registers, so it can just read from whatever it needs, write to whatever registers, and then it's done in however many clock cycles it takes to compute it.

217
00:16:53,000 --> 00:16:57,860
It just makes it a lot faster than having to deal with drivers and a bus and stuff like that.

218
00:17:00,600 --> 00:17:02,420
Okay, now onto the fun stuff.

219
00:17:03,340 --> 00:17:05,740
Chipper is what we call this thing.

220
00:17:05,740 --> 00:17:12,980
It was originally PicoCrack, but our boss didn't like PicoCrack because it had a drug name in it or something.

221
00:17:14,700 --> 00:17:21,560
We thought that we'd try and start a new term for cracking on FPGAs called Chipping.

222
00:17:23,280 --> 00:17:31,460
This thing is called Chipper and currently supports Unix DES, Windows Landman, Windows NTLM, and multiple FPGAs and cards.

223
00:17:32,980 --> 00:17:33,620
Chipper?

224
00:17:36,120 --> 00:17:37,960
Yeah, yeah, yeah, there you go.

225
00:17:38,320 --> 00:17:39,660
It kind of has a ring to it.

226
00:17:39,920 --> 00:17:43,880
If you're going to make a project like this, use our terminology so we can get popular, okay?

227
00:17:46,300 --> 00:17:52,320
By the way, with the multiple cards and FPGAs thing, this thing was supposed to have 10 of our cards in it.

228
00:17:52,320 --> 00:17:54,120
You can kind of see them down here at the bottom.

229
00:17:55,360 --> 00:17:57,120
But three of them didn't work.

230
00:17:57,120 --> 00:18:00,740
They gave me 12 of them, and three of them didn't work, so I only have nine in there.

231
00:18:04,820 --> 00:18:06,300
Yeah, Landman hashes.

232
00:18:06,300 --> 00:18:08,320
Everybody knows what Landman is?

233
00:18:08,340 --> 00:18:10,020
Yeah, kind of, basically.

234
00:18:10,080 --> 00:18:12,260
It's really shitty crypto for passwords.

235
00:18:12,720 --> 00:18:16,340
So, you have a password that's like 14 characters long.

236
00:18:16,340 --> 00:18:20,300
It splits it in half, encrypts them separately, and then appends the two hashes together.

237
00:18:20,300 --> 00:18:26,180
So, you can basically crack them separately, and then only have to search seven characters instead of 14.

238
00:18:29,060 --> 00:18:34,540
And hardware design is basically... the whole cracking engine is done on the card.

239
00:18:34,680 --> 00:18:39,440
There's a key generator that generates passwords and then feeds them to the DES operation.

240
00:18:40,480 --> 00:18:42,020
That's basically what it does.

241
00:18:42,020 --> 00:18:44,940
It generates a bunch of keys, encrypts them, and compares them.

242
00:18:47,640 --> 00:18:50,200
And you can specify how many bits you want to search.

243
00:18:50,300 --> 00:18:56,020
So, if you want to split it up into four different cards, you can crack it four times faster by just splitting up the key space.

244
00:18:56,560 --> 00:19:04,860
And you can specify if you want to search typable or just printable characters, or alphanumeric, and basic stuff like that.

245
00:19:07,340 --> 00:19:10,280
And we threw together this software interface.

246
00:19:10,300 --> 00:19:11,860
I'm going to demo the Windows version.

247
00:19:11,940 --> 00:19:15,300
If we had an extra day, we would have it running on Linux with all the cards.

248
00:19:15,300 --> 00:19:19,900
But yeah, if you guys want to see it some other time, I can show you.

249
00:19:20,760 --> 00:19:22,900
And, by the way, thanks to Rakhni.

250
00:19:22,920 --> 00:19:27,760
She built most of the GUI code and a lot of the architecture of the software for this.

251
00:19:29,980 --> 00:19:31,260
Round of applause.

252
00:19:39,850 --> 00:19:42,010
Somebody needs to beat him up later.

253
00:19:48,490 --> 00:19:52,730
So, we use WXWidgets, which supports Windows, Linux, everything.

254
00:19:52,910 --> 00:19:56,030
Once we get this all built, it will run on pretty much every platform.

255
00:19:56,030 --> 00:19:57,550
It will have a nice GUI for it.

256
00:19:57,850 --> 00:20:03,510
Runout supports cracking 128 keys in parallel on each card, or 128 hashes.

257
00:20:03,790 --> 00:20:05,770
And supports a faster mode.

258
00:20:05,770 --> 00:20:08,450
If you just want to crack one password, you can do it four times faster.

259
00:20:08,450 --> 00:20:12,690
Because we just do one compare and then put on four cores.

260
00:20:13,710 --> 00:20:16,770
And it can automatically load required FPGA image.

261
00:20:16,770 --> 00:20:21,450
So , depending on what you're doing, it will automatically load the right card image and stuff.

262
00:20:22,210 --> 00:20:25,690
And supports multiple card clusters, which I'll be demoing.

263
00:20:27,230 --> 00:20:31,210
So, here's some speed information.

264
00:20:31,410 --> 00:20:36,890
Right now on a PC, this is probably pretty low compared to some people that write optimized stuff.

265
00:20:36,890 --> 00:20:42,190
But , has anybody used any sort of desk cracking, or, you know, like, NTLM cracking?

266
00:20:42,390 --> 00:20:44,490
What sort of performance do you get?

267
00:20:44,490 --> 00:20:48,670
Like, 3 million cribs per second?

268
00:20:50,150 --> 00:20:51,290
Rainbow crack?

269
00:20:51,290 --> 00:20:52,750
Oh, so you use a rainbow table?

270
00:20:53,350 --> 00:20:58,910
Okay, yeah, I was running rainbow crack, and it was generating my hash table at about 2 million keys per second.

271
00:20:58,910 --> 00:21:03,170
I think that you can probably do maybe up to, like, 6 or 8 or something like that.

272
00:21:03,170 --> 00:21:05,250
If you have something really optimized, maybe 10.

273
00:21:05,570 --> 00:21:10,550
And that's on, like, you know, modern P4 or AMD64 or whatever.

274
00:21:11,450 --> 00:21:15,890
In hardware, right now, each card will do 125 million per second.

275
00:21:15,890 --> 00:21:20,370
And if you just want to crack one password, it'll do 500 million.

276
00:21:20,770 --> 00:21:27,710
And the main problem is that we can clock it a lot faster, but we're running into heat issues and power issues.

277
00:21:27,870 --> 00:21:34,990
And so, we're going to be experimenting with, like, liquid nitrogen cooling and other sorts of cooling to just cool it down.

278
00:21:34,990 --> 00:21:39,050
Because, in theory, we should be able to get it up to, like, 1 million keys per second.

279
00:21:39,590 --> 00:21:40,910
I mean, 1 billion.

280
00:21:41,570 --> 00:21:44,870
So, it should be a lot faster whenever we get that running.

281
00:21:46,910 --> 00:21:48,510
There's some basic information.

282
00:21:48,530 --> 00:21:57,070
On a P4, you can crack, if you just have a 64-character table, because that'd be, like, alphanumeric and then, like, 32 symbols or something like that.

283
00:21:57,250 --> 00:21:59,890
You can do it in about 25 days on a P4.

284
00:22:00,090 --> 00:22:02,350
On one of our cards, it'll do it in about 2 hours.

285
00:22:02,890 --> 00:22:06,730
And if you have 8 of them, in about 18 minutes or so.

286
00:22:07,930 --> 00:22:09,690
And, let's see, 48 characters.

287
00:22:09,690 --> 00:22:11,230
Yeah, you can just read that.

288
00:22:11,470 --> 00:22:16,550
But basically, if you're just doing alphanumeric, you can get it down to about 9 seconds on one of our cards.

289
00:22:16,790 --> 00:22:20,130
And I'm just going to show, like, the baseline sort of attack.

290
00:22:20,130 --> 00:22:29,910
It'll take about 4 minutes for going through, let's see, 128 times 9, about 1,000 passwords it'll be cracking in parallel.

291
00:22:41,770 --> 00:22:43,870
So, yeah, this is our card.

292
00:22:44,450 --> 00:22:46,550
It has a Vertex 4 on it.

293
00:22:46,570 --> 00:22:48,330
You can get it with a PowerPC processor.

294
00:22:48,330 --> 00:22:54,070
It has RAM, ROM, gigabit Ethernet, and all that on a little thing like this.

295
00:22:54,410 --> 00:22:57,030
It's basically a full-on computer if you get it with a processor.

296
00:22:58,130 --> 00:22:59,830
Okay, here's the cool part.

297
00:23:04,170 --> 00:23:04,970
This is...

298
00:23:05,850 --> 00:23:08,830
It's going to

299
00:23:22,390 --> 00:23:24,430
load the bling bling image here.

300
00:23:28,040 --> 00:23:29,520
So now it's running that image.

301
00:23:38,940 --> 00:23:40,260
So this is our little program.

302
00:23:40,260 --> 00:23:42,140
It's still called PicoCraft, we'll end up being Chipper.

303
00:23:47,590 --> 00:23:52,890
So I just loaded in this PWDump file, and it's already starting to crack them.

304
00:23:53,790 --> 00:23:56,030
I'll show you what this file looks like.

305
00:24:04,670 --> 00:24:07,010
So this is just a standard PWDump file.

306
00:24:07,650 --> 00:24:10,010
And it's got some fake accounts in there.

307
00:24:12,290 --> 00:24:25,210
But, yeah, it's cracking, let's see, 64 in parallel right now on just this card in my laptop, and it's going at 125 million keys per second, so it's a little bit faster than if I just used my laptop.

308
00:24:27,210 --> 00:24:27,890
And then...

309
00:24:27,890 --> 00:24:30,970
So we can just let this run, and I'll fire up the next demo.

310
00:24:31,290 --> 00:24:33,070
Wow, we've got plenty of time here, wow.

311
00:24:34,950 --> 00:24:35,930
Just a sec.

312
00:25:30,090 --> 00:25:31,010
There we go.

313
00:25:35,950 --> 00:25:42,910
So all I can demo here is just our command line version, but the graphical version will be pretty close to being done.

314
00:25:42,910 --> 00:25:43,370
So...

315
00:25:46,580 --> 00:25:48,560
Oh, you've got to hear this, this is funny.

316
00:26:02,190 --> 00:26:07,850
I'm guessing that people use PCMCACS on their laptops, and they hear that dinging thing.

317
00:26:12,160 --> 00:26:16,280
I've got nine PCMCACS, or ten PCMCACS lockets in here.

318
00:26:21,900 --> 00:26:22,820
Alright.

319
00:26:22,820 --> 00:26:22,920
So...

320
00:26:47,570 --> 00:26:59,050
So that's a PWM file of like 4,000 passwords, and this will just start scrolling a ton of stuff, so...

321
00:27:00,570 --> 00:27:01,990
There we go.

322
00:27:02,550 --> 00:27:06,430
Over on the right is a count of how many passwords it's cracked so far.

323
00:27:16,450 --> 00:27:27,130
And this is like the slow mode, it's just doing 125 million per second on each card, and it's cracking 128 in parallel for each card.

324
00:27:27,210 --> 00:27:32,730
There's a faster mode where I can do basically like 500 million times 10.

325
00:27:33,150 --> 00:27:36,670
So what's that, like 5 billion keys per second or something like that for just one?

326
00:27:36,990 --> 00:27:39,310
But this looks a lot cooler.

327
00:27:41,250 --> 00:27:43,810
So yeah, this will be running for a little bit.

328
00:27:45,530 --> 00:27:46,490
Whoa.

329
00:27:57,840 --> 00:27:58,720
Yeah, um...

330
00:28:01,820 --> 00:28:03,200
Well, I'll...

331
00:28:06,120 --> 00:28:06,600
Well...

332
00:28:07,320 --> 00:28:13,860
Well no, with Landman, it splits it up into two seven-character chunks, and so this is actually...

333
00:28:13,860 --> 00:28:15,320
Oh wow, that's crazy.

334
00:28:16,400 --> 00:28:19,720
Yeah, yeah, they're 14 characters, and...

335
00:28:19,720 --> 00:28:26,920
No special characters, it's just alphanumeric with 64 characters, and it would take like a couple hours or something like that.

336
00:28:29,200 --> 00:28:31,540
But this will take about three minutes.

337
00:28:32,220 --> 00:28:40,520
It's basically taking all the hashes from this file, and then slowly filling them in, and then as they're getting cracked, it's replacing them and continuing on.

338
00:28:40,520 --> 00:28:44,280
So this thing will run forever until 4,000 are cracked.

339
00:28:44,280 --> 00:28:51,960
It'll go through the whole keyspace in about three or four minutes for this, and if you're doing 64-bit, then it would be a bit longer.

340
00:28:52,520 --> 00:28:54,700
Or the 64-character search thing.

341
00:28:54,700 --> 00:28:59,800
So yeah, you don't have the crazy stuff, but it would just take a little longer.

342
00:29:18,010 --> 00:29:28,670
Yeah, I know I don't have support for this, because we're still in the middle of building everything, and we just kind of hacked this thing together in the last hour, but I might be able to...

343
00:29:28,670 --> 00:29:32,830
I'm not sure if I have the right image on my laptop, but I might be able to show you something.

344
00:29:36,760 --> 00:29:38,500
Oh, each of our cards?

345
00:29:39,440 --> 00:29:42,500
With all the software, they're $2,800 each.

346
00:29:43,260 --> 00:29:50,620
And if you are a developer, or you don't need all the software, then probably about $1,500 to $1,000, something like that.

347
00:29:50,640 --> 00:29:56,100
You can buy development boards that have the same chip on them for about $400, maybe.

348
00:29:56,800 --> 00:30:02,180
And they don't really come with any extra stuff, but they're cheap, and you can build a huge array of them if you want to.

349
00:30:02,180 --> 00:30:03,660
They're about this big.

350
00:30:04,160 --> 00:30:05,320
A lot bigger.

351
00:30:17,900 --> 00:30:19,780
Yeah, yeah, something like that.

352
00:30:20,020 --> 00:30:23,300
And if you buy more than one, then the price usually drops, I don't know.

353
00:30:23,300 --> 00:30:24,960
It really depends on the sales we need.

354
00:30:26,660 --> 00:30:29,240
Oh yeah, so here, all of these are cracked, I think.

355
00:30:29,560 --> 00:30:30,320
There we go.

356
00:30:30,800 --> 00:30:33,020
So yeah, you see, they're all 14 characters long.

357
00:30:33,020 --> 00:30:43,580
They aren't really that extraordinary as far as the actual characters, but it's also upper and lowercase, because Landman makes everything uppercase when you type in your password, so it's case insensitive.

358
00:30:44,100 --> 00:30:45,280
What should you change?

359
00:30:52,740 --> 00:31:01,520
Well, Linux is a lot more difficult, because with DES, they run it through like 25 rounds at least, and so you have to run DES 25 times.

360
00:31:01,520 --> 00:31:03,140
Most of the time, they'll run it even more.

361
00:31:03,240 --> 00:31:06,020
If you're doing like MD5, MD5 runs pretty slow.

362
00:31:06,880 --> 00:31:09,800
So it's a lot slower to crack the Linux stuff.

363
00:31:10,160 --> 00:31:12,700
I just went on this stuff because it's a lot easier.

364
00:31:13,900 --> 00:31:16,630
What should you throw together?

365
00:31:16,870 --> 00:31:19,410
On that, I've thrown together some.

366
00:31:19,410 --> 00:31:20,650
I don't have it with me, though.

367
00:31:21,150 --> 00:31:23,870
If you email me, I can get you some more information about that.

368
00:31:23,870 --> 00:31:26,690
With NTLM, it's pretty comparable to this.

369
00:31:26,710 --> 00:31:33,630
The only difference is that the passwords are a lot bigger, so if you want to crack a 16-character password, it'll take a long time.

370
00:31:33,990 --> 00:31:39,510
And then it's also case sensitive, so you've got the uppercase and the lowercase you have to worry about.

371
00:31:40,850 --> 00:31:43,570
Let me see if I have this right image here.

372
00:31:58,310 --> 00:31:59,450
What's that?

373
00:32:02,390 --> 00:32:03,350
DES?

374
00:32:09,910 --> 00:32:13,730
Yeah, well, for just cracking straight DES.

375
00:32:14,590 --> 00:32:17,990
No, I don't have any of that, but the landmine is pretty much just straight DES.

376
00:32:18,210 --> 00:32:20,670
So the performance will be the same.

377
00:32:24,490 --> 00:32:25,350
What's that?

378
00:32:27,150 --> 00:32:28,710
It's about the same as this.

379
00:32:29,190 --> 00:32:35,990
It takes up a little more space, so in the fast mode, I can only fit three cores on there instead of four, but it's pretty much the same specs.

380
00:32:39,980 --> 00:32:40,860
What's that?

381
00:32:49,760 --> 00:32:52,620
Yeah, right now it's mainly the bus.

382
00:32:53,020 --> 00:33:01,380
That's the limitation for generating rainbow tables, because if you're generating 500 million hashes per second, just getting that off the card is pretty difficult.

383
00:33:02,700 --> 00:33:14,280
We've been talking with the Shmoo guys with the rainbow cracking stuff they've been doing, and we've been exploring different possibilities with that, but they're really interested in trying to use something like this to generate it faster.

384
00:33:14,760 --> 00:33:24,060
It seems like our best bet would be using the Gigabit Ethernet to get it off the card, but still, then you have to worry about finding hard drives or RAM that can cache it that fast.

385
00:33:24,220 --> 00:33:26,260
I don't know.

386
00:33:26,260 --> 00:33:27,780
It's one thing that we're working on.

387
00:33:30,120 --> 00:33:30,660
What's that?

388
00:33:30,660 --> 00:33:31,520
Yeah, yeah.

389
00:33:31,820 --> 00:33:32,660
There you go.

390
00:33:37,230 --> 00:33:38,110
Hard cards?

391
00:33:38,550 --> 00:33:42,250
They're all PCMCA compact flash, basically.

392
00:33:42,430 --> 00:33:44,970
But then there's also an Ethernet dongle at the back.

393
00:33:48,170 --> 00:33:48,990
No, no, no.

394
00:33:48,990 --> 00:33:51,170
I've got ten PCMCA slots in here.

395
00:33:53,750 --> 00:33:57,430
Yeah, I've got five of the two card adapter things.

396
00:33:59,750 --> 00:34:00,490
Yeah, yeah.

397
00:34:00,490 --> 00:34:01,330
They're all PCI.

398
00:34:05,360 --> 00:34:07,960
We're going to be making a PCI Express board.

399
00:34:08,160 --> 00:34:10,040
That's going to be a few months down the road.

400
00:34:11,220 --> 00:34:12,200
Oh, yeah, yeah.

401
00:34:12,200 --> 00:34:14,760
That would definitely work for doing

402
00:34:18,530 --> 00:34:19,090
that.

403
00:34:19,510 --> 00:34:24,890
Yeah, so we'll probably work on that once we get a card that can talk fast enough for it.

404
00:34:26,690 --> 00:34:29,530
Let me try and see if this works.

405
00:34:37,780 --> 00:34:38,800
A secret service?

406
00:34:40,000 --> 00:34:41,040
What's that?

407
00:34:42,700 --> 00:34:43,740
Oh!

408
00:34:51,130 --> 00:34:52,070
Yeah, yeah.

409
00:34:52,070 --> 00:34:56,030
The CIA is using that on all their PCs, too, right?

410
00:34:56,310 --> 00:34:57,890
I remember reading about that.

411
00:34:58,310 --> 00:34:59,570
Oh, okay.

412
00:35:13,890 --> 00:35:14,970
Yeah.

413
00:35:28,420 --> 00:35:29,400
Missing stuff?

414
00:35:33,440 --> 00:35:34,400
Oh, yeah, yeah, yeah.

415
00:35:34,400 --> 00:35:35,480
The graphics and stuff.

416
00:35:35,480 --> 00:35:37,220
Yeah, I'll post that up there.

417
00:35:37,440 --> 00:35:38,840
I don't know why those got lost.

418
00:35:45,770 --> 00:35:48,250
You know, these probably won't work.

419
00:36:07,050 --> 00:36:07,770
Whoa.

420
00:36:09,610 --> 00:36:12,070
Yeah, I think this is a totally incompatible version.

421
00:36:12,070 --> 00:36:26,400
But, yeah, if you look at the performance here, you can do basically all the printable characters, like one of them in two hours, or eight of them in 18 minutes.

422
00:36:26,780 --> 00:36:32,260
So it's like two hours versus 20 minutes, or two hours versus one minute right now.

423
00:36:32,560 --> 00:36:36,520
So it'd just take a little bit longer if you wanted to do a lot more characters.

424
00:36:39,060 --> 00:36:40,080
What was that?

425
00:36:43,970 --> 00:36:45,410
Oh, for the full length?

426
00:36:46,110 --> 00:36:47,750
Yeah, yeah, that's for the full length.

427
00:36:48,670 --> 00:36:51,050
So, like, up to 14 characters, we plan that.

428
00:36:52,750 --> 00:36:55,870
There's just a few more slides here, and then I can let you guys go.

429
00:37:00,120 --> 00:37:03,160
So, I just started this opencyphers.org.

430
00:37:03,520 --> 00:37:05,560
I've got all the source for this stuff.

431
00:37:06,340 --> 00:37:11,320
It isn't posted up there right now, there's just some details on it, but it'll be posted fairly shortly.

432
00:37:11,320 --> 00:37:19,500
I also wrote a ModX core, if you guys want to do any RSA or Diffie-Hellman, or any sort of stuff like that.

433
00:37:19,580 --> 00:37:24,720
I did an A5 implementation for some GSM stuff I'm working on.

434
00:37:27,280 --> 00:37:36,740
Basically, the technology trends, it seems like right now there's always small devices that use really weak crypto, just because they're limited by cost and speed and stuff.

435
00:37:36,740 --> 00:37:53,300
And then, basically, I don't see simple brute force attacks really living that long, just because the key sizes are getting really large, but I definitely think that there's lots of potential for doing really more elegant attacks with cryptanalysis on FPGAs,

436
00:37:53,300 --> 00:37:55,420
and just doing it a lot faster.

437
00:37:55,780 --> 00:38:03,140
And I really think that's going to be the next generation of everything, and people are starting to do it, and so that's really the future.

438
00:38:03,140 --> 00:38:04,840
Hardware trends.

439
00:38:05,920 --> 00:38:15,960
It seems like FPGAs are increasing according to Moore's Law, just because they use the same sort of processes that processors use for manufacturing and stuff.

440
00:38:17,560 --> 00:38:27,620
And really, the factors are pretty similar, but you just end up with a lot more density, which you're kind of getting in the newer processors, like dual-core and stuff like that.

441
00:38:27,900 --> 00:38:33,120
But it seems like there's definitely some algorithms out there that you can exploit with FPGAs.

442
00:38:33,780 --> 00:38:44,340
Some future applications we'll be working on are neural network stuff, attacks on web, WPA, PSM, and analysis and correlation.

443
00:38:44,520 --> 00:38:46,620
There's some interesting stuff you can do with that.

444
00:38:48,100 --> 00:38:50,900
Any feedback, any other questions, or anything like that?

445
00:38:57,040 --> 00:38:59,620
Yeah, I remember somebody told me about it.

446
00:38:59,620 --> 00:39:01,240
I haven't looked at it too much, though.

447
00:39:01,240 --> 00:39:06,360
But yeah, I remember they used some FPGAs to speed up cracking the hashes and stuff.

448
00:39:08,160 --> 00:39:09,500
Oh, cool.

449
00:39:10,280 --> 00:39:12,180
Yeah, I'll definitely take a look at that.

450
00:39:12,680 --> 00:39:14,340
Anybody else have any suggestions?

451
00:39:17,060 --> 00:39:19,840
Any other suggestions or comments or anything like that?

452
00:39:22,600 --> 00:39:24,360
Yeah, that's a very good suggestion.

453
00:39:24,580 --> 00:39:28,940
If you really want to get into this stuff, just come up and we can work something out.

454
00:39:28,940 --> 00:39:32,060
But anything else?

455
00:39:33,920 --> 00:39:36,940
Okay, a couple of shameful plugs here.

456
00:39:36,940 --> 00:39:38,820
There's TorCon and ShmooCon.

457
00:39:38,920 --> 00:39:42,500
ShmooCon's an awesome conference, if you guys want to go to that.

458
00:39:42,500 --> 00:39:44,380
Everybody know what ShmooCon is?

459
00:39:45,220 --> 00:39:45,680
No?

460
00:39:45,680 --> 00:39:46,180
Yeah?

461
00:39:49,420 --> 00:39:50,980
Oh, shoot.

462
00:39:50,980 --> 00:39:51,540
San Diego.

463
00:39:51,540 --> 00:39:53,640
I probably just copied and pasted that.

464
00:39:53,640 --> 00:39:57,200
But it's in February, it's in DC, I'll have to fix that also.

465
00:39:57,200 --> 00:40:01,440
I threw together most of this presentation in an hour before this thing.

466
00:40:03,980 --> 00:40:08,000
OpenCyphers.org, OpenCores.org has a bunch of open source cores that you can use.

467
00:40:08,000 --> 00:40:09,380
Lots of crypto stuff.

468
00:40:10,600 --> 00:40:17,520
You can go to Xilinx, download their eval software, set your clock ahead ten years and get it for free.

469
00:40:17,900 --> 00:40:22,320
And Pico Computing is the company that I'm a part of.

470
00:40:22,480 --> 00:40:24,260
And actually, here, you've got to check this out.

471
00:40:24,260 --> 00:40:25,280
This is hilarious.

472
00:40:32,560 --> 00:40:38,900
So, our hardware developer decided to put these stickers on this thing, and I'm not sure what they mean.

473
00:40:41,500 --> 00:40:43,080
I don't know.

474
00:40:43,640 --> 00:40:45,180
He's kind of weird.

475
00:40:46,120 --> 00:40:50,860
But, yeah, that's our box, and it cracks stuff.

476
00:40:51,520 --> 00:40:56,580
It's basically half as fast as the EFF's desk cracker, I think.

477
00:40:57,280 --> 00:41:02,200
And theirs took up, I think, a few cabinets and cost $250,000.

478
00:41:03,340 --> 00:41:04,820
That's one of our products.

479
00:41:04,820 --> 00:41:06,340
And any other questions?

480
00:41:06,340 --> 00:41:07,020
That's it.

481
00:41:07,840 --> 00:41:09,140
Okay, thanks a lot for coming.