Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie
Hi there,
There is an issue with role permissions that is being worked on at the moment.
If you are having trouble with access or permissions on regional forums please post here to get access: https://www.boards.ie/discussion/2058365403/you-do-not-have-permission-for-that#latest

Acrobat 8 passwords more secure than Acrobat 9

  • 07-01-2009 9:49pm
    #1
    Capt'n Midnight
    Moderators, Recreation & Hobbies Moderators, Science, Health & Environment Moderators, Technology & Internet Moderators Posts: 93,596 Mod ✭✭✭✭


    "actually security level is determined by the weakest link. In case if strong cryptography is used, the weakest link is a password - it could be guessed much easily than encryption key. Computers become faster every year. And common practice is to increase complexity of password testing process in new versions of software. But Adobe decided to make password testing faster."

    They are going from a 128 bit system to a 256 bit encryption which is 1,000's of times easier to brute force :rolleyes:

    http://blogs.zdnet.com/security/?p=2271&tag=rbxccnbzd1
    Q: Compared to Adobe Reader 8.0, how has your brute force rate improved by taking advantage of the flaw in numbers?

    A: In Acrobat versions from 5 to 8, it was needed to make 51 MD5 calls and 20 RC4 calls, making password verification relatively slow, and so brute-force attacks were not effective — only about 50,000 passwords per second on modern Intel processor, so even 6-character password was strong enough.

    In Acrobat version 9, password checking routine consist of just one call to SHA256 hash function. That function can be implemented really effectively on all modern CPUs with SSE2 instruction set, with linear scalability on multi-core and multi-CPU systems, allowing to reach the speed from 5 to 10 million passwords per second. Moreover, SHA256 algorithm fits really good to stream processors such as ones used in NVIDIA video cards, reaching the speed of up to 100 million passwords per second on a single GPU, again with a linear scalability to multi-GPU systems and Tesla. That makes even 8-character password (mixed uppercase and lowercase letters) not secure.

    To be more precise, Q6600 - iCore 4 cores on 2.4GHz :

    Acrobat 8 ~ 56 700 p/s for user password
    Acrobat 9 ~ 5 100 000 p/s for user password on one core
    Acrobat 9 ~ 20 350 000 p/s on Q6600 (4 cores)

    GPU GTX260 has 192 stream processors:
    Acrobat 9 ~ 74 500 000 p/s


Advertisement