WEBVTT 00:08.870 --> 00:10.290 Thank you very much. 00:10.950 --> 00:14.230 I guess that's a pretty good reason not to go to TorCon, but... 00:26.200 --> 00:32.140 Okay, so quite a lot of people were over in the other room for my other presentation, right? 00:32.140 --> 00:32.580 Yeah? 00:33.020 --> 00:33.960 Okay, cool. 00:35.260 --> 00:36.940 So yeah, this is my presentation. 00:37.880 --> 00:45.820 A little background about everything that happened with other thing was I checked on the DEF CON website like last week to see when I was speaking. 00:46.040 --> 00:51.920 And as you can see on the slide over there, like going along the left-hand side, it says July 30th. 00:52.500 --> 00:58.320 And that's when I thought that I was going to speak, but I guess they moved me to July 29th or something like that. 00:58.740 --> 01:04.980 And so I thought I was speaking tomorrow and I thought that I had an extra 24 hours to prepare everything, but I didn't. 01:04.980 --> 01:12.980 And so in the middle of coding all this stuff together, I got a call from one of our friends saying that I was supposed to be speaking right then, earlier today. 01:13.240 --> 01:21.260 And we were over at Caesars Palace, kind of far away, and I don't know if you saw this big box over here, but it weighs about 100 pounds and it carries all this crap. 01:21.700 --> 01:29.260 So it was a little difficult to get over here, and then once we got over here, they just decided to put some other people on and move me somewhere else. 01:29.300 --> 01:30.820 But this is my talk. 01:30.820 --> 01:34.840 I'm sorry that I didn't show up for the other one, if you guys waited in line or anything like that. 01:35.800 --> 01:38.640 If you did wait in line and you're angry at me, go and have some more beer. 01:38.640 --> 01:39.920 I think we have some more left here. 01:43.020 --> 01:45.220 You have to fight George first, I think. 01:51.560 --> 01:55.900 Okay, so if you want to fight George, feel free to. 01:55.900 --> 01:57.200 The winner gets free beer. 01:59.620 --> 02:01.400 Okay, so this is my talk. 02:01.400 --> 02:07.320 I'm going to be talking about basically cracking crypto on FPGAs and some different things that people are doing. 02:11.560 --> 02:16.640 And just if you don't know anything about me, I started this thing called DocBodenLabs. 02:16.640 --> 02:17.640 We made BSDR tools. 02:17.640 --> 02:19.740 I did some smart card hacking stuff a while back. 02:20.540 --> 02:21.580 I run TorCon. 02:21.780 --> 02:23.200 George helps out with TorCon. 02:23.200 --> 02:25.400 There's a bunch of other people here that help out with TorCon, too. 02:25.400 --> 02:26.340 But it's in San Diego. 02:26.340 --> 02:27.660 He already told you the info. 02:29.880 --> 02:32.160 I'm starting this company called Pico Computing. 02:32.160 --> 02:34.660 We've got our huge logo on the side of this thing. 02:34.660 --> 02:37.580 We make FPGA cards that are really expensive. 02:40.520 --> 02:43.120 If you have a lot of money, please buy our cards. 02:43.120 --> 02:44.840 If you don't, then buy somebody else's. 02:46.660 --> 02:47.780 Our disclaimer. 02:48.460 --> 02:49.820 Educational purposes only. 02:49.820 --> 02:51.500 All that crap. 02:53.220 --> 02:56.880 I'm going to be covering an introduction to FPGAs. 02:56.880 --> 02:59.400 First of all, who here knows what an FPGA is? 03:00.140 --> 03:00.960 Oh, wow. 03:01.060 --> 03:02.020 Awesome. 03:02.100 --> 03:04.480 I can just fast-forward through that, then. 03:04.680 --> 03:06.480 Some GateLogic crap. 03:06.840 --> 03:08.080 Cracking with hardware. 03:08.220 --> 03:14.060 I'm just going to cover some of the stuff that other people have done in regards to cracking stuff on FPGAs. 03:14.320 --> 03:19.200 Cover some optimizations that you can use to speed up your code and hardware. 03:19.200 --> 03:25.440 And introduce this program called Chipper, which we just named a couple days ago and just started coding a couple days ago. 03:25.920 --> 03:29.540 It does Landman and NTLM cracking for Windows. 03:29.540 --> 03:32.060 It does it about 100 times faster than a PC. 03:32.060 --> 03:35.940 On one of our tiny little cards that's a compact flash card size. 03:37.180 --> 03:43.740 I have to safely remove this thing. 03:44.120 --> 03:47.640 Otherwise, our driver stops working. 03:47.640 --> 03:48.980 There's some bugs in it. 03:58.610 --> 04:00.030 PCMCIA card. 04:00.430 --> 04:02.750 This is our card that we make. 04:02.750 --> 04:07.030 It's got a FPGA on it that cracks stuff 100 times faster than a PC. 04:08.170 --> 04:10.410 It's just a compact flash card. 04:10.830 --> 04:12.850 I'll cover more of the details later. 04:13.590 --> 04:19.270 I'll give a demo of what this box does and give you some performance information. 04:20.470 --> 04:24.090 First of all, an FPGA lets you prototype integrated circuits. 04:24.870 --> 04:26.390 Basically, you write code. 04:26.390 --> 04:30.770 It translates directly into gate logic and stuff that runs on the FPGA. 04:33.290 --> 04:40.950 There's the basic logic, boolean sort of stuff that you can do with gates and stuff. 04:43.350 --> 04:49.550 You can implement adders and all sorts of other more complex gates using just really simple basic components. 04:50.970 --> 04:53.450 You can chain them together and do all sorts of crazy stuff. 04:53.450 --> 05:01.690 That's basically what electronics is based off of, just using small little bitwise operations and chaining them together to do more complex stuff. 05:02.750 --> 05:07.290 You can also use gates to store values if you want to make memory. 05:07.290 --> 05:11.290 Most flash memory is based off of a bunch of gates that just store values. 05:15.070 --> 05:18.190 They can be implemented with electronics pretty simply. 05:21.730 --> 05:22.830 Let's see here. 05:23.490 --> 05:25.350 Gates can be configured arbitrarily. 05:25.390 --> 05:26.890 You just have a bunch of different gates on there. 05:26.890 --> 05:29.890 You can say, I want to connect this one with this one. 05:29.890 --> 05:32.950 I want to connect this to this other component that I have. 05:33.430 --> 05:43.990 Instead of designing your whole thing and burning it to a chip or having a bunch of small little gates that you connect together with wires, it basically connects all the wires for you and has some basic components that you can use. 05:44.590 --> 05:47.530 With an FPGA, you can create almost any type of logic. 05:47.530 --> 05:50.530 You're just bound by the size of the device. 05:52.130 --> 05:54.170 An FPGA just looks kind of like this. 05:54.170 --> 05:59.030 You have a bunch of CLBs that have registers and basic logic routing stuff. 05:59.390 --> 06:06.530 Those are those little... I'm not sure if you can see it, but the red areas are composed of a bunch of little small cells. 06:07.110 --> 06:11.970 Then there's input-output blocks, block RAM, digital clock managers. 06:11.970 --> 06:19.210 You can also get FPGAs with built-in power PCs or built-in processors if you want to actually have a real processor. 06:20.750 --> 06:24.090 There's a programmable routing matrix that allows you to connect everything together. 06:25.770 --> 06:30.630 The pros of using hardware is you can do massively parallel stuff. 06:30.630 --> 06:33.530 You have a bunch of gates that are pretty much active all the time. 06:33.530 --> 06:37.250 You don't have to worry about just running one instruction at a time. 06:37.250 --> 06:39.130 You can have a bunch of things running at the same time. 06:39.130 --> 06:42.990 And you can pipeline stuff, which is basically kind of the same thing as parallelizing. 06:46.290 --> 06:52.470 The other nice thing about FPGAs is that with an ASIC, you just burn all the gates to a chip and you're done with it. 06:52.470 --> 06:55.190 With an FPGA, you can reconfigure it a bunch of times. 06:55.510 --> 06:57.030 It makes it easy to prototype stuff. 06:57.030 --> 07:00.030 You can also have them reconfigure themselves and things like that. 07:00.910 --> 07:04.710 The cons are that you have size constraints and limitations. 07:05.250 --> 07:08.710 It's a little more difficult to code and debug than with software. 07:11.670 --> 07:14.910 There's some common applications for FPGAs. 07:15.670 --> 07:18.690 I'm just going to be focusing on encryption and decryption. 07:20.390 --> 07:22.290 Different types of FPGAs. 07:22.310 --> 07:28.730 There's anti-fuse ones where you just tell it how the gates should be configured and it just stays that way forever. 07:28.730 --> 07:30.210 You can't reprogram them. 07:30.210 --> 07:35.370 There's flash ones, which you can program and they'll keep their state even when you power them off and stuff. 07:35.690 --> 07:39.270 And then there's SRAM ones where you have to configure them every time they start up. 07:39.270 --> 07:44.650 So you basically have a port and you feed a bunch of configuration stuff into it and it configures itself that way. 07:45.590 --> 07:47.330 SRAM is the most common technology. 07:47.330 --> 07:49.350 It scales better for the larger FPGAs. 07:49.430 --> 07:51.410 The only problem is that it requires a loader. 07:55.010 --> 07:57.790 There's a few different FPGA manufacturers. 07:57.970 --> 07:59.570 We use Xilinx FPGAs. 07:59.570 --> 08:03.190 There's also Altera, which I think is a lot bigger with academic places. 08:03.190 --> 08:05.530 Does anybody here use Xilinx or Altera? 08:05.530 --> 08:06.210 Xilinx? 08:06.210 --> 08:06.930 Anybody? 08:07.070 --> 08:07.990 Xilinx? 08:08.330 --> 08:09.050 Altera? 08:09.050 --> 08:09.730 Anybody? 08:10.250 --> 08:11.030 One? 08:11.690 --> 08:12.690 Two? 08:12.690 --> 08:13.410 Okay. 08:13.610 --> 08:17.310 The main difference is they kind of have the same sort of chips. 08:17.310 --> 08:21.810 Xilinx is a lot bigger company and a lot more commercial. 08:21.810 --> 08:31.930 And you can also get them with an optional power PC that will actually run up to like 300-400 MHz as opposed to like a soft core which only goes to like 1 or 150 or something like that. 08:34.450 --> 08:36.310 So how do you program these things? 08:36.310 --> 08:38.710 There's a programming language called Verilog. 08:38.710 --> 08:42.210 You can also use VHDL, but most of my stuff is in Verilog. 08:42.310 --> 08:46.270 And it has a simple C-like syntax and it's really simple. 08:47.390 --> 08:49.710 It's really easy to learn but difficult to master. 08:52.330 --> 08:55.870 So a basic code comparison between the two. 08:55.870 --> 09:01.030 This is kind of stupid, but if you want to do an OR with C, then you just kind of... 09:01.030 --> 09:02.490 or an AND, sorry. 09:02.690 --> 09:07.270 And then with Verilog, it's kind of the same thing where you assign and... 09:07.270 --> 09:07.810 I don't know. 09:08.630 --> 09:09.790 Hey, stop laughing. 09:12.620 --> 09:15.440 And so if you want to do like an 8-bit AND, then it's kind of the same thing. 09:15.440 --> 09:21.260 You can have data buses in Verilog where you can specify how many bits you want the variable to be and then just do operations on them. 09:22.620 --> 09:26.880 And you aren't limited by like 8 bits or 16 bits or 32 bits or whatever. 09:27.980 --> 09:29.260 And then you can... 09:29.820 --> 09:33.260 then you basically just have flip-flops for storage if you want to save state or... 09:34.120 --> 09:38.440 or basically have something that gets configured a certain way and then... 09:38.440 --> 09:42.300 you know, in every sort of trigger, you can create a flip-flop. 09:43.440 --> 09:48.600 And that's really all you have is wires and flip-flops and other sorts of components that are actually on the device. 09:48.600 --> 09:50.480 And you can do a lot with just that. 09:52.260 --> 09:56.520 So I'm going to cover the history of FPGAs and cryptography. 09:56.640 --> 10:03.940 Just to start this out, there are a bunch of these guys that wrote this paper a while back on minimal key lengths and symmetric ciphers. 10:03.940 --> 10:08.120 There's Shimomura on there, there's Rivest, Schneier, all those people. 10:08.300 --> 10:24.340 And they did some research to try and figure out like the best key lengths that people should be using that would protect you against the common attacker, like a kid in his basement, major corporations, or NSA. 10:25.180 --> 10:29.220 And so this is basically what they came to the conclusion of. 10:30.060 --> 10:43.020 Basically, a kid in his basement could take a tiny FPGA, $400, and crack 40 bits in about 5 hours, or 56 bits in 38 years. 10:43.020 --> 10:48.140 And then at the very bottom you have an intelligence agency with a budget of about $300 million. 10:48.460 --> 10:53.320 And they can crack 40 bits in pretty much real time, and 56 bits in 12 seconds. 10:53.580 --> 10:56.600 And this is what they found with their research. 10:58.020 --> 11:00.120 And this was published in 1996. 11:02.240 --> 11:09.640 So it's kind of scary that most likely the government can crack 56-bit encryption, blah blah blah. 11:09.640 --> 11:15.420 But everybody's using 128, you know, 256, and that's like way much more difficult than this. 11:15.460 --> 11:18.460 So it's not saying much, but it's still a little bit scary. 11:20.860 --> 11:31.580 So the EFF in 1998 built a desk cracker that could crack, well it ended up cracking desks in 3 days, and it ended up winning like the RC4 challenge or whatever. 11:31.580 --> 11:34.400 Or the, sorry, the Desk Distributed On-Net Challenge. 11:34.400 --> 11:38.280 And they claimed that they did about 9 billion keys per second. 11:38.280 --> 11:39.480 They could search. 11:40.040 --> 11:44.740 And it cost them a little less than $250,000, including engineering and all that stuff. 11:45.720 --> 11:46.960 Has anybody heard of that? 11:46.960 --> 11:48.440 EFF Desk Cracker? 11:52.320 --> 11:57.880 There's these other guys that hacked ATM machines using an FPGA, just because they needed to crack it a little bit faster. 11:59.800 --> 12:01.800 These guys are really interesting. 12:01.800 --> 12:06.720 They actually implemented a linear cryptanalysis attack on desks using FPGAs. 12:06.720 --> 12:11.120 Basically you need to compute a big dictionary and then do lookups. 12:12.800 --> 12:16.780 It's a chosen plain text attack, so it isn't really that crazy. 12:16.780 --> 12:22.140 I mean, if you had some sort of device and you were trying to figure out the key in it, then you could do this sort of attack. 12:22.140 --> 12:26.520 But if you're just trying to decrypt a document, it's not going to help you that much. 12:28.620 --> 12:37.060 They were able to recover a key in 10 seconds with a 72% success rate, as opposed to about 5 months, I think, or 5 years, a really long time. 12:39.500 --> 12:44.580 There's a bunch of other people implementing stuff and cracking RC4 and all sorts of crazy stuff. 12:45.220 --> 12:48.020 There's quite a few people out there that are doing this stuff. 12:50.540 --> 13:01.340 Basically, the way that you can exploit FPGAs to get really crazy performance out of them is on a PC, you do a simple for loop or something like that. 13:01.340 --> 13:03.280 It takes a certain amount of time. 13:03.280 --> 13:04.360 You have to do it sequentially. 13:08.180 --> 13:10.580 Basically, in hardware, you can do it all in parallel. 13:11.100 --> 13:16.720 Instead of having a for loop where you have to go through each iteration and compute whatever, you can do it all in parallel. 13:21.260 --> 13:23.420 Okay, just use your imaginations. 13:28.980 --> 13:30.400 Then there's a pipeline example. 13:30.400 --> 13:32.920 There is a pipeline there, you just can't see it. 13:33.420 --> 13:34.840 It's down there. 13:36.220 --> 13:40.860 Basically, if you're trying to perform a bunch of different operations, you can have... 13:42.360 --> 13:43.960 Okay, that kind of sucks. 13:45.820 --> 13:55.740 Basically, you have information that flows in on one end, and you have a register that stores a value for that state where it's some value plus one. 13:55.740 --> 14:02.660 If you need to subtract another number from it, then you do the subtraction stage in the next stage. 14:03.240 --> 14:06.560 Then this has that value plus one minus whatever. 14:06.680 --> 14:09.340 Then over here, you have the next value that's fed in. 14:09.340 --> 14:15.400 You can basically have all these parallel operations going while you're performing elements sequentially. 14:17.460 --> 14:26.500 Essentially, the speed of the whole pipeline is equivalent to the fastest or slowest operation in the pipeline. 14:27.340 --> 14:34.700 If your addition somewhere is the slowest thing, that's as slow as the pipeline is going to be, plus how many clock cycles it takes to go through the whole thing. 14:37.720 --> 14:40.040 That's a really common way of optimizing things. 14:40.040 --> 14:41.940 It's basically just parallelizing things. 14:43.740 --> 14:49.580 Another nice thing is with self-reconfiguration, you get an advantage over ASICs. 14:54.340 --> 15:00.900 Essentially, if you need to multiply some arrays, you can load on a core that multiplies arrays. 15:01.040 --> 15:08.280 Then you can switch it out with your RC4 core and RC4 it, and then switch it out with MD5 and MD5 it. 15:08.540 --> 15:11.620 You don't have to have three different chips or one huge chip. 15:11.620 --> 15:15.420 You can just reconfigure it with specific parts of whatever you need to do. 15:18.400 --> 15:21.820 There are some special components that you can use with Vertex 4s. 15:21.820 --> 15:24.320 Anybody heard of the DSP48 slice? 15:25.860 --> 15:28.300 It's a new thing with the Vertex 4s. 15:31.460 --> 15:36.980 You can do 18x18 multipliers, 48x48 bit adders. 15:37.920 --> 15:41.600 It does 18x18 multipliers at 500 MHz, which is pretty decent. 15:42.160 --> 15:51.880 It's not that great compared to a PC, but you have 48 of them, so you can do 48 18x18 multipliers in parallel at 500 MHz. 15:51.880 --> 15:52.980 That's pretty decent. 15:54.180 --> 15:56.600 There's also block RAM that you can use for storage. 15:56.700 --> 15:57.680 They're pretty fast. 15:57.680 --> 15:58.740 They have FIFO support. 15:58.740 --> 16:01.260 If you just need a FIFO, it's all built in. 16:01.440 --> 16:04.300 They have these sort of components that people commonly use. 16:04.300 --> 16:06.540 They commonly use FIFOs, adders, and multipliers. 16:06.540 --> 16:13.180 They just build them in as hard components, so you can utilize them and they're extremely optimized for whatever they need to do. 16:14.660 --> 16:20.560 Another really interesting thing is that if you get a Vertex 4 with a PowerPC, they have this new thing called the APU. 16:21.200 --> 16:30.600 Basically, you can create your own instructions on the PowerPC and have it execute your Verilog code or your hardware code. 16:30.600 --> 16:34.280 You can essentially make a DES instruction. 16:34.420 --> 16:37.660 You just run this instruction and it runs DES on whatever it needs. 16:39.340 --> 16:41.620 There's lots of really cool things you can do with it. 16:41.740 --> 16:52.880 Basically, your code has access to all the registers, so it can just read from whatever it needs, write to whatever registers, and then it's done in however many clock cycles it takes to compute it. 16:53.000 --> 16:57.860 It just makes it a lot faster than having to deal with drivers and a bus and stuff like that. 17:00.600 --> 17:02.420 Okay, now onto the fun stuff. 17:03.340 --> 17:05.740 Chipper is what we call this thing. 17:05.740 --> 17:12.980 It was originally PicoCrack, but our boss didn't like PicoCrack because it had a drug name in it or something. 17:14.700 --> 17:21.560 We thought that we'd try and start a new term for cracking on FPGAs called Chipping. 17:23.280 --> 17:31.460 This thing is called Chipper and currently supports Unix DES, Windows Landman, Windows NTLM, and multiple FPGAs and cards. 17:32.980 --> 17:33.620 Chipper? 17:36.120 --> 17:37.960 Yeah, yeah, yeah, there you go. 17:38.320 --> 17:39.660 It kind of has a ring to it. 17:39.920 --> 17:43.880 If you're going to make a project like this, use our terminology so we can get popular, okay? 17:46.300 --> 17:52.320 By the way, with the multiple cards and FPGAs thing, this thing was supposed to have 10 of our cards in it. 17:52.320 --> 17:54.120 You can kind of see them down here at the bottom. 17:55.360 --> 17:57.120 But three of them didn't work. 17:57.120 --> 18:00.740 They gave me 12 of them, and three of them didn't work, so I only have nine in there. 18:04.820 --> 18:06.300 Yeah, Landman hashes. 18:06.300 --> 18:08.320 Everybody knows what Landman is? 18:08.340 --> 18:10.020 Yeah, kind of, basically. 18:10.080 --> 18:12.260 It's really shitty crypto for passwords. 18:12.720 --> 18:16.340 So, you have a password that's like 14 characters long. 18:16.340 --> 18:20.300 It splits it in half, encrypts them separately, and then appends the two hashes together. 18:20.300 --> 18:26.180 So, you can basically crack them separately, and then only have to search seven characters instead of 14. 18:29.060 --> 18:34.540 And hardware design is basically... the whole cracking engine is done on the card. 18:34.680 --> 18:39.440 There's a key generator that generates passwords and then feeds them to the DES operation. 18:40.480 --> 18:42.020 That's basically what it does. 18:42.020 --> 18:44.940 It generates a bunch of keys, encrypts them, and compares them. 18:47.640 --> 18:50.200 And you can specify how many bits you want to search. 18:50.300 --> 18:56.020 So, if you want to split it up into four different cards, you can crack it four times faster by just splitting up the key space. 18:56.560 --> 19:04.860 And you can specify if you want to search typable or just printable characters, or alphanumeric, and basic stuff like that. 19:07.340 --> 19:10.280 And we threw together this software interface. 19:10.300 --> 19:11.860 I'm going to demo the Windows version. 19:11.940 --> 19:15.300 If we had an extra day, we would have it running on Linux with all the cards. 19:15.300 --> 19:19.900 But yeah, if you guys want to see it some other time, I can show you. 19:20.760 --> 19:22.900 And, by the way, thanks to Rakhni. 19:22.920 --> 19:27.760 She built most of the GUI code and a lot of the architecture of the software for this. 19:29.980 --> 19:31.260 Round of applause. 19:39.850 --> 19:42.010 Somebody needs to beat him up later. 19:48.490 --> 19:52.730 So, we use WXWidgets, which supports Windows, Linux, everything. 19:52.910 --> 19:56.030 Once we get this all built, it will run on pretty much every platform. 19:56.030 --> 19:57.550 It will have a nice GUI for it. 19:57.850 --> 20:03.510 Runout supports cracking 128 keys in parallel on each card, or 128 hashes. 20:03.790 --> 20:05.770 And supports a faster mode. 20:05.770 --> 20:08.450 If you just want to crack one password, you can do it four times faster. 20:08.450 --> 20:12.690 Because we just do one compare and then put on four cores. 20:13.710 --> 20:16.770 And it can automatically load required FPGA image. 20:16.770 --> 20:21.450 So , depending on what you're doing, it will automatically load the right card image and stuff. 20:22.210 --> 20:25.690 And supports multiple card clusters, which I'll be demoing. 20:27.230 --> 20:31.210 So, here's some speed information. 20:31.410 --> 20:36.890 Right now on a PC, this is probably pretty low compared to some people that write optimized stuff. 20:36.890 --> 20:42.190 But , has anybody used any sort of desk cracking, or, you know, like, NTLM cracking? 20:42.390 --> 20:44.490 What sort of performance do you get? 20:44.490 --> 20:48.670 Like, 3 million cribs per second? 20:50.150 --> 20:51.290 Rainbow crack? 20:51.290 --> 20:52.750 Oh, so you use a rainbow table? 20:53.350 --> 20:58.910 Okay, yeah, I was running rainbow crack, and it was generating my hash table at about 2 million keys per second. 20:58.910 --> 21:03.170 I think that you can probably do maybe up to, like, 6 or 8 or something like that. 21:03.170 --> 21:05.250 If you have something really optimized, maybe 10. 21:05.570 --> 21:10.550 And that's on, like, you know, modern P4 or AMD64 or whatever. 21:11.450 --> 21:15.890 In hardware, right now, each card will do 125 million per second. 21:15.890 --> 21:20.370 And if you just want to crack one password, it'll do 500 million. 21:20.770 --> 21:27.710 And the main problem is that we can clock it a lot faster, but we're running into heat issues and power issues. 21:27.870 --> 21:34.990 And so, we're going to be experimenting with, like, liquid nitrogen cooling and other sorts of cooling to just cool it down. 21:34.990 --> 21:39.050 Because, in theory, we should be able to get it up to, like, 1 million keys per second. 21:39.590 --> 21:40.910 I mean, 1 billion. 21:41.570 --> 21:44.870 So, it should be a lot faster whenever we get that running. 21:46.910 --> 21:48.510 There's some basic information. 21:48.530 --> 21:57.070 On a P4, you can crack, if you just have a 64-character table, because that'd be, like, alphanumeric and then, like, 32 symbols or something like that. 21:57.250 --> 21:59.890 You can do it in about 25 days on a P4. 22:00.090 --> 22:02.350 On one of our cards, it'll do it in about 2 hours. 22:02.890 --> 22:06.730 And if you have 8 of them, in about 18 minutes or so. 22:07.930 --> 22:09.690 And, let's see, 48 characters. 22:09.690 --> 22:11.230 Yeah, you can just read that. 22:11.470 --> 22:16.550 But basically, if you're just doing alphanumeric, you can get it down to about 9 seconds on one of our cards. 22:16.790 --> 22:20.130 And I'm just going to show, like, the baseline sort of attack. 22:20.130 --> 22:29.910 It'll take about 4 minutes for going through, let's see, 128 times 9, about 1,000 passwords it'll be cracking in parallel. 22:41.770 --> 22:43.870 So, yeah, this is our card. 22:44.450 --> 22:46.550 It has a Vertex 4 on it. 22:46.570 --> 22:48.330 You can get it with a PowerPC processor. 22:48.330 --> 22:54.070 It has RAM, ROM, gigabit Ethernet, and all that on a little thing like this. 22:54.410 --> 22:57.030 It's basically a full-on computer if you get it with a processor. 22:58.130 --> 22:59.830 Okay, here's the cool part. 23:04.170 --> 23:04.970 This is... 23:05.850 --> 23:08.830 It's going to 23:22.390 --> 23:24.430 load the bling bling image here. 23:28.040 --> 23:29.520 So now it's running that image. 23:38.940 --> 23:40.260 So this is our little program. 23:40.260 --> 23:42.140 It's still called PicoCraft, we'll end up being Chipper. 23:47.590 --> 23:52.890 So I just loaded in this PWDump file, and it's already starting to crack them. 23:53.790 --> 23:56.030 I'll show you what this file looks like. 24:04.670 --> 24:07.010 So this is just a standard PWDump file. 24:07.650 --> 24:10.010 And it's got some fake accounts in there. 24:12.290 --> 24:25.210 But, yeah, it's cracking, let's see, 64 in parallel right now on just this card in my laptop, and it's going at 125 million keys per second, so it's a little bit faster than if I just used my laptop. 24:27.210 --> 24:27.890 And then... 24:27.890 --> 24:30.970 So we can just let this run, and I'll fire up the next demo. 24:31.290 --> 24:33.070 Wow, we've got plenty of time here, wow. 24:34.950 --> 24:35.930 Just a sec. 25:30.090 --> 25:31.010 There we go. 25:35.950 --> 25:42.910 So all I can demo here is just our command line version, but the graphical version will be pretty close to being done. 25:42.910 --> 25:43.370 So... 25:46.580 --> 25:48.560 Oh, you've got to hear this, this is funny. 26:02.190 --> 26:07.850 I'm guessing that people use PCMCACS on their laptops, and they hear that dinging thing. 26:12.160 --> 26:16.280 I've got nine PCMCACS, or ten PCMCACS lockets in here. 26:21.900 --> 26:22.820 Alright. 26:22.820 --> 26:22.920 So... 26:47.570 --> 26:59.050 So that's a PWM file of like 4,000 passwords, and this will just start scrolling a ton of stuff, so... 27:00.570 --> 27:01.990 There we go. 27:02.550 --> 27:06.430 Over on the right is a count of how many passwords it's cracked so far. 27:16.450 --> 27:27.130 And this is like the slow mode, it's just doing 125 million per second on each card, and it's cracking 128 in parallel for each card. 27:27.210 --> 27:32.730 There's a faster mode where I can do basically like 500 million times 10. 27:33.150 --> 27:36.670 So what's that, like 5 billion keys per second or something like that for just one? 27:36.990 --> 27:39.310 But this looks a lot cooler. 27:41.250 --> 27:43.810 So yeah, this will be running for a little bit. 27:45.530 --> 27:46.490 Whoa. 27:57.840 --> 27:58.720 Yeah, um... 28:01.820 --> 28:03.200 Well, I'll... 28:06.120 --> 28:06.600 Well... 28:07.320 --> 28:13.860 Well no, with Landman, it splits it up into two seven-character chunks, and so this is actually... 28:13.860 --> 28:15.320 Oh wow, that's crazy. 28:16.400 --> 28:19.720 Yeah, yeah, they're 14 characters, and... 28:19.720 --> 28:26.920 No special characters, it's just alphanumeric with 64 characters, and it would take like a couple hours or something like that. 28:29.200 --> 28:31.540 But this will take about three minutes. 28:32.220 --> 28:40.520 It's basically taking all the hashes from this file, and then slowly filling them in, and then as they're getting cracked, it's replacing them and continuing on. 28:40.520 --> 28:44.280 So this thing will run forever until 4,000 are cracked. 28:44.280 --> 28:51.960 It'll go through the whole keyspace in about three or four minutes for this, and if you're doing 64-bit, then it would be a bit longer. 28:52.520 --> 28:54.700 Or the 64-character search thing. 28:54.700 --> 28:59.800 So yeah, you don't have the crazy stuff, but it would just take a little longer. 29:18.010 --> 29:28.670 Yeah, I know I don't have support for this, because we're still in the middle of building everything, and we just kind of hacked this thing together in the last hour, but I might be able to... 29:28.670 --> 29:32.830 I'm not sure if I have the right image on my laptop, but I might be able to show you something. 29:36.760 --> 29:38.500 Oh, each of our cards? 29:39.440 --> 29:42.500 With all the software, they're $2,800 each. 29:43.260 --> 29:50.620 And if you are a developer, or you don't need all the software, then probably about $1,500 to $1,000, something like that. 29:50.640 --> 29:56.100 You can buy development boards that have the same chip on them for about $400, maybe. 29:56.800 --> 30:02.180 And they don't really come with any extra stuff, but they're cheap, and you can build a huge array of them if you want to. 30:02.180 --> 30:03.660 They're about this big. 30:04.160 --> 30:05.320 A lot bigger. 30:17.900 --> 30:19.780 Yeah, yeah, something like that. 30:20.020 --> 30:23.300 And if you buy more than one, then the price usually drops, I don't know. 30:23.300 --> 30:24.960 It really depends on the sales we need. 30:26.660 --> 30:29.240 Oh yeah, so here, all of these are cracked, I think. 30:29.560 --> 30:30.320 There we go. 30:30.800 --> 30:33.020 So yeah, you see, they're all 14 characters long. 30:33.020 --> 30:43.580 They aren't really that extraordinary as far as the actual characters, but it's also upper and lowercase, because Landman makes everything uppercase when you type in your password, so it's case insensitive. 30:44.100 --> 30:45.280 What should you change? 30:52.740 --> 31:01.520 Well, Linux is a lot more difficult, because with DES, they run it through like 25 rounds at least, and so you have to run DES 25 times. 31:01.520 --> 31:03.140 Most of the time, they'll run it even more. 31:03.240 --> 31:06.020 If you're doing like MD5, MD5 runs pretty slow. 31:06.880 --> 31:09.800 So it's a lot slower to crack the Linux stuff. 31:10.160 --> 31:12.700 I just went on this stuff because it's a lot easier. 31:13.900 --> 31:16.630 What should you throw together? 31:16.870 --> 31:19.410 On that, I've thrown together some. 31:19.410 --> 31:20.650 I don't have it with me, though. 31:21.150 --> 31:23.870 If you email me, I can get you some more information about that. 31:23.870 --> 31:26.690 With NTLM, it's pretty comparable to this. 31:26.710 --> 31:33.630 The only difference is that the passwords are a lot bigger, so if you want to crack a 16-character password, it'll take a long time. 31:33.990 --> 31:39.510 And then it's also case sensitive, so you've got the uppercase and the lowercase you have to worry about. 31:40.850 --> 31:43.570 Let me see if I have this right image here. 31:58.310 --> 31:59.450 What's that? 32:02.390 --> 32:03.350 DES? 32:09.910 --> 32:13.730 Yeah, well, for just cracking straight DES. 32:14.590 --> 32:17.990 No, I don't have any of that, but the landmine is pretty much just straight DES. 32:18.210 --> 32:20.670 So the performance will be the same. 32:24.490 --> 32:25.350 What's that? 32:27.150 --> 32:28.710 It's about the same as this. 32:29.190 --> 32:35.990 It takes up a little more space, so in the fast mode, I can only fit three cores on there instead of four, but it's pretty much the same specs. 32:39.980 --> 32:40.860 What's that? 32:49.760 --> 32:52.620 Yeah, right now it's mainly the bus. 32:53.020 --> 33:01.380 That's the limitation for generating rainbow tables, because if you're generating 500 million hashes per second, just getting that off the card is pretty difficult. 33:02.700 --> 33:14.280 We've been talking with the Shmoo guys with the rainbow cracking stuff they've been doing, and we've been exploring different possibilities with that, but they're really interested in trying to use something like this to generate it faster. 33:14.760 --> 33:24.060 It seems like our best bet would be using the Gigabit Ethernet to get it off the card, but still, then you have to worry about finding hard drives or RAM that can cache it that fast. 33:24.220 --> 33:26.260 I don't know. 33:26.260 --> 33:27.780 It's one thing that we're working on. 33:30.120 --> 33:30.660 What's that? 33:30.660 --> 33:31.520 Yeah, yeah. 33:31.820 --> 33:32.660 There you go. 33:37.230 --> 33:38.110 Hard cards? 33:38.550 --> 33:42.250 They're all PCMCA compact flash, basically. 33:42.430 --> 33:44.970 But then there's also an Ethernet dongle at the back. 33:48.170 --> 33:48.990 No, no, no. 33:48.990 --> 33:51.170 I've got ten PCMCA slots in here. 33:53.750 --> 33:57.430 Yeah, I've got five of the two card adapter things. 33:59.750 --> 34:00.490 Yeah, yeah. 34:00.490 --> 34:01.330 They're all PCI. 34:05.360 --> 34:07.960 We're going to be making a PCI Express board. 34:08.160 --> 34:10.040 That's going to be a few months down the road. 34:11.220 --> 34:12.200 Oh, yeah, yeah. 34:12.200 --> 34:14.760 That would definitely work for doing 34:18.530 --> 34:19.090 that. 34:19.510 --> 34:24.890 Yeah, so we'll probably work on that once we get a card that can talk fast enough for it. 34:26.690 --> 34:29.530 Let me try and see if this works. 34:37.780 --> 34:38.800 A secret service? 34:40.000 --> 34:41.040 What's that? 34:42.700 --> 34:43.740 Oh! 34:51.130 --> 34:52.070 Yeah, yeah. 34:52.070 --> 34:56.030 The CIA is using that on all their PCs, too, right? 34:56.310 --> 34:57.890 I remember reading about that. 34:58.310 --> 34:59.570 Oh, okay. 35:13.890 --> 35:14.970 Yeah. 35:28.420 --> 35:29.400 Missing stuff? 35:33.440 --> 35:34.400 Oh, yeah, yeah, yeah. 35:34.400 --> 35:35.480 The graphics and stuff. 35:35.480 --> 35:37.220 Yeah, I'll post that up there. 35:37.440 --> 35:38.840 I don't know why those got lost. 35:45.770 --> 35:48.250 You know, these probably won't work. 36:07.050 --> 36:07.770 Whoa. 36:09.610 --> 36:12.070 Yeah, I think this is a totally incompatible version. 36:12.070 --> 36:26.400 But, yeah, if you look at the performance here, you can do basically all the printable characters, like one of them in two hours, or eight of them in 18 minutes. 36:26.780 --> 36:32.260 So it's like two hours versus 20 minutes, or two hours versus one minute right now. 36:32.560 --> 36:36.520 So it'd just take a little bit longer if you wanted to do a lot more characters. 36:39.060 --> 36:40.080 What was that? 36:43.970 --> 36:45.410 Oh, for the full length? 36:46.110 --> 36:47.750 Yeah, yeah, that's for the full length. 36:48.670 --> 36:51.050 So, like, up to 14 characters, we plan that. 36:52.750 --> 36:55.870 There's just a few more slides here, and then I can let you guys go. 37:00.120 --> 37:03.160 So, I just started this opencyphers.org. 37:03.520 --> 37:05.560 I've got all the source for this stuff. 37:06.340 --> 37:11.320 It isn't posted up there right now, there's just some details on it, but it'll be posted fairly shortly. 37:11.320 --> 37:19.500 I also wrote a ModX core, if you guys want to do any RSA or Diffie-Hellman, or any sort of stuff like that. 37:19.580 --> 37:24.720 I did an A5 implementation for some GSM stuff I'm working on. 37:27.280 --> 37:36.740 Basically, the technology trends, it seems like right now there's always small devices that use really weak crypto, just because they're limited by cost and speed and stuff. 37:36.740 --> 37:53.300 And then, basically, I don't see simple brute force attacks really living that long, just because the key sizes are getting really large, but I definitely think that there's lots of potential for doing really more elegant attacks with cryptanalysis on FPGAs, 37:53.300 --> 37:55.420 and just doing it a lot faster. 37:55.780 --> 38:03.140 And I really think that's going to be the next generation of everything, and people are starting to do it, and so that's really the future. 38:03.140 --> 38:04.840 Hardware trends. 38:05.920 --> 38:15.960 It seems like FPGAs are increasing according to Moore's Law, just because they use the same sort of processes that processors use for manufacturing and stuff. 38:17.560 --> 38:27.620 And really, the factors are pretty similar, but you just end up with a lot more density, which you're kind of getting in the newer processors, like dual-core and stuff like that. 38:27.900 --> 38:33.120 But it seems like there's definitely some algorithms out there that you can exploit with FPGAs. 38:33.780 --> 38:44.340 Some future applications we'll be working on are neural network stuff, attacks on web, WPA, PSM, and analysis and correlation. 38:44.520 --> 38:46.620 There's some interesting stuff you can do with that. 38:48.100 --> 38:50.900 Any feedback, any other questions, or anything like that? 38:57.040 --> 38:59.620 Yeah, I remember somebody told me about it. 38:59.620 --> 39:01.240 I haven't looked at it too much, though. 39:01.240 --> 39:06.360 But yeah, I remember they used some FPGAs to speed up cracking the hashes and stuff. 39:08.160 --> 39:09.500 Oh, cool. 39:10.280 --> 39:12.180 Yeah, I'll definitely take a look at that. 39:12.680 --> 39:14.340 Anybody else have any suggestions? 39:17.060 --> 39:19.840 Any other suggestions or comments or anything like that? 39:22.600 --> 39:24.360 Yeah, that's a very good suggestion. 39:24.580 --> 39:28.940 If you really want to get into this stuff, just come up and we can work something out. 39:28.940 --> 39:32.060 But anything else? 39:33.920 --> 39:36.940 Okay, a couple of shameful plugs here. 39:36.940 --> 39:38.820 There's TorCon and ShmooCon. 39:38.920 --> 39:42.500 ShmooCon's an awesome conference, if you guys want to go to that. 39:42.500 --> 39:44.380 Everybody know what ShmooCon is? 39:45.220 --> 39:45.680 No? 39:45.680 --> 39:46.180 Yeah? 39:49.420 --> 39:50.980 Oh, shoot. 39:50.980 --> 39:51.540 San Diego. 39:51.540 --> 39:53.640 I probably just copied and pasted that. 39:53.640 --> 39:57.200 But it's in February, it's in DC, I'll have to fix that also. 39:57.200 --> 40:01.440 I threw together most of this presentation in an hour before this thing. 40:03.980 --> 40:08.000 OpenCyphers.org, OpenCores.org has a bunch of open source cores that you can use. 40:08.000 --> 40:09.380 Lots of crypto stuff. 40:10.600 --> 40:17.520 You can go to Xilinx, download their eval software, set your clock ahead ten years and get it for free. 40:17.900 --> 40:22.320 And Pico Computing is the company that I'm a part of. 40:22.480 --> 40:24.260 And actually, here, you've got to check this out. 40:24.260 --> 40:25.280 This is hilarious. 40:32.560 --> 40:38.900 So, our hardware developer decided to put these stickers on this thing, and I'm not sure what they mean. 40:41.500 --> 40:43.080 I don't know. 40:43.640 --> 40:45.180 He's kind of weird. 40:46.120 --> 40:50.860 But, yeah, that's our box, and it cracks stuff. 40:51.520 --> 40:56.580 It's basically half as fast as the EFF's desk cracker, I think. 40:57.280 --> 41:02.200 And theirs took up, I think, a few cabinets and cost $250,000. 41:03.340 --> 41:04.820 That's one of our products. 41:04.820 --> 41:06.340 And any other questions? 41:06.340 --> 41:07.020 That's it. 41:07.840 --> 41:09.140 Okay, thanks a lot for coming.