Evaluating Master Password Security: How Many Bits Are Enough for Economic Safety?

Many thanks for your reply, it was very informative!

I addition to the sources you mentioned (Aaron Toponce and Steve Thomas), I am adding Chick3nman’s Hashcat v6.2.6 benchmark on the Nvidia RTX 4090

With your logical reasoning and the sources available, I tried to start a new discussion with ChatGPT. This time, my goal was to obtain estimates of the cracking speeds of different hardware for various scenarios:

  • plaintext passphrase
  • PBKDF2-SHA256 with 600,000 iterations
  • Argon2id with 64MB memory, 4 threads of parallelism, and 3 iterations.

After some interactions, these are the tables provided:

Table 1: Cracking a Plaintext Passphrase (No Hashing)

Hardware Cracking Speed (Guesses/s) Hardware Cost (USD) Power Consumption (Watts)
Nvidia A100 ~100-110 billion ~$11,000 ~400
Nvidia H100 ~150-170 billion ~$35,000 ~700
Nvidia RTX 4090 ~265 billion ~$1,600 ~450
AMD RX 7900 XTX ~150 billion ~$900 ~355
FPGA (Virtex UltraScale+) ~1-2 billion ~$25,000 ~300
ASIC (Bitmain Antminer S21 Pro) ~300-350 billion ~$5,000 ~3200
ASIC (Custom) ~500 billion+ ~$30,000+ ~6000

Table 2: Cracking a Passphrase with PBKDF2-SHA256 (600,000 Iterations)

Hardware Cracking Speed (Guesses/s) Hardware Cost (USD) Power Consumption (Watts)
Nvidia A100 ~2,500-3,000 ~$11,000 ~400
Nvidia H100 ~3,500-4,000 ~$35,000 ~700
Nvidia RTX 4090 ~2,000-2,500 ~$1,600 ~450
AMD RX 7900 XTX ~1,500-2,000 ~$900 ~355
FPGA (Virtex UltraScale+) ~500-800 ~$25,000 ~300
ASIC (Bitmain Antminer S21 Pro) ~50,000-100,000 ~$5,000 ~3200
ASIC (Custom) ~100,000+ ~$30,000+ ~6000

Table 3: Cracking a Passphrase with Argon2id (64MB Memory, 4 Parallelism, 3 Iterations)

Hardware Cracking Speed (Guesses/s) Hardware Cost (USD) Power Consumption (Watts)
Nvidia A100 ~80-100 ~$11,000 ~400
Nvidia H100 ~100-150 ~$35,000 ~700
Nvidia RTX 4090 ~60-100 ~$1,600 ~450
AMD RX 7900 XTX ~50-80 ~$900 ~355
FPGA (Virtex UltraScale+) ~10-25 ~$25,000 ~300
ASIC (Bitmain Antminer S21 Pro) ~30-50 ~$5,000 ~3200
ASIC (Custom) ~50-100 ~$30,000+ ~6000

Any feedback on the estimates provided? It seems underestimating cracking speeds compared to your assumptions

EDIT 11/25/24
ChatGPT estimates are wrong, please don’t trust these numbers