SHA-1 Cracking On A Budget

cloude-pottier writes "An enterprising individual went on eBay and found boards with more than half a dozen Virtex II Pro FPGAs, nursed them back to life and build a SHA-1 cracker with two of the boards. This is an excellent example of recycling, as these were originally a part of a Thompson Grass Valley HDTV broadcast system. As a part of the project, the creator wrote tools designed to graph the relationships between components. He also used JTAG to make reverse engineering the organization of the FPGAs on the board more apparent. More details can be seen on the actual project page."

Re:SHA-cracker?

[archen]

Perhaps this gets brought up each time, but what are we supposed to use for password encryption anyway? MD5 seems to be inadequate. SHA-1 is also waning. I switched to Blowfish on all my FreeBSD servers partially because of MD5 problems, but also because it's not a common format to come across for anyone figuring they'd just have MD5 hashes to try - I understand however that blowfish was not intended for this purpose.

But it seems like MD5 and SHA are getting weaker by the day with computational power on the rise. Right now I'm setting up an email server (dovecot/postfix) and the strongest hash schemes are of course MD5 and SHA. That's all that almost all email clients support anyway. But it doesn't seem like anyone has a replacement, nor is anyone moving towards anything else, and I haven't seen any real talk about it. I know there was talk about a new hash algorithm contenst similar to the one that took place for AES, but honestly we need the new hashing algorithm out TODAY so we can start to see the extremely slow vendor support start to creep in.