Using a Bitcoin or Litecoin miner for attacking PBKDF2 / SHA-256

Question

I'm wondering if it would be possible to utilize a Bitcoin or Litecoin miner to attack, say, a password database that uses PKBDF2 with HMAC / SHA-256. PBKDF2 uses multiple iterations of a PRF - usually HMAC-SHA1, but sometimes HMAC-SHA-256 - for protecting passwords. The idea is that these calculations have to be performed for each password, so that makes it more difficult for an attacker to test all passwords. The PBKDF2 method is defined in RFC 2898.

Sometimes statements are made that these functions are insecure because of attacks with ASICs and often total amount of Bitcoin SHA-256 hashes is shown as example of what can be done. Now I'm wondering if it would be possible to program a Bitcoin or Litecoin miner to find a password using brute force or a dictionary attack.

Assumptions:

• HMAC SHA-256
• the salt is known
• output of PBKDF2 is 256 bit (the output of the hash) or less
• "high" number of iterations, say 4K to 40K

To do this you would have to program HMAC using a single SHA-256. Furthermore, you probably would have to have a method to perform the iterations. The iterations use the same key (derived from the password) for HMAC but the data is dependent on the previous value. Obviously there also needs to be some way to generate or retrieve the candidate passwords.

Would it be possible to reprogram a miner to do this work, or are all the current miners too specialized to perform such operations? Is there a - possibly older - miner that can be reprogrammed to do this work?

---

Note that this question is about reprogramming/re-utilizing a hardware device. It is not a generic question of using the Bitcoin network to perform cryptographic tasks.

---

I've added Litecoin to the mix. Litecoin uses scrypt, which is already a Password Based Key Derivation Function in itself, which uses PBKDF2 as underlying PRF (hope that's OK, no answers yet).

Answer 1

Would it be possible to reprogram a miner to do this work, or are all the current miners too specialized to perform such operations?

A Bitcoin mining ASIC can only do a single task, mining, it has no ability to do anything further than take an 80 byte header, hash it, and return a nonce if it has a large enough of zero bits. In terms of applicability to general SHA256 computing tasks, it has no relevance whatsoever. They can not do single SHA256, return under any circumstance but a low hash, and can not hash arbitrary data. Scrypt based ASICs do exist, but they are hardcoded to stupidly low parameters nobody would use for password hashing in the real world, the other caveats also apply.

Is there a - possibly older - miner that can be reprogrammed to do this work?

A FPGA can be reprogrammed to do almost any task you take the time to author a bitstream for, it would be possible in some circumstances use FPGA for attacking hashes. The Bitcoin mining FPGA that were used in around 2013 do not have much relevance however, as they were never designed for high bandwidth performance between the host and the chip. You might have been communicating over a 9600 baud serial connection which is too slow to send any significant amount of data across.

GPUs are generally used for this sort of task instead, where you have extremely fast and low latency connections to the CPU and a high degree of concurrency for computing hashes. The efficiency is not as high as dedicated hardware (FPGA or ASIC), but they are commodity devices which can be used for a lot more of these sort of tasks. A high end card can compute in the order of half a billion SHA256 hashes a second when the input is only several compression rounds long, though it will burn upwards of 400W while doing so.