>Nine quintillion computations; 6,500 years of CPU; 110 years of GPU
Is there a rough calculation in terms of today's $$$ cost to implement the attack?
Is there a rough calculation in terms of today's $$$ cost to implement the attack?
> The monetary cost of computing the second block of the
> attack by renting Amazon instances can be estimated from
> these various data. Using a p2.16xlarge instance,
> featuring 16 K80 GPUs and nominally costing
> US$ 14.4 per hour would cost US$ 560 K for the
> necessary 71 device years. It would be more economical
> for a patient attacker to wait for low “spot prices” of
> the smaller g2.8xlarge instances, which feature four K520
> GPUs, roughly equivalent to a K40 or a GTX 970. Assuming
> thusly an effort of 100 device years, and a typical spot
> price of US$ 0.5 per hour, the overall cost would be of
> US$ 110 K.
Because if we can drive storage costs much closer to zero (e.g.: a beefed up local server), we can keep storing hashes and the next collision should be much closer. Starting and stopping and throwing away the previous work does work out to $560K per collision, but doesn't it just keep getting cheaper if you keep going?
There isn't anything new about this result actually, Google just set aside the necessary resources to demonstrate it.
I think that was the point. Google wanted to show that anyone with sufficient resources could easily pull this off.
> Using a p2.16xlarge instance, featuring 16 K80 GPUs and nominally costing US 14.4 per hour would cost US 560 K for the necessary 71 device years
If I'm reading that correctly, 852 (71 * 12) K80 cards gets that down to a month, which sounds well within the reach of NSA et al.
Even getting it down to a day (71 * 12 * 30=25,560 cards) seems feasible. Assuming $10k per card ($5k launch price + doubled to account for supporting hardware), the upfront investment is around $0.25 billion, a figure that sounds plausible given, e.g., that the Utah data centre is budgeted at around $2 billion.
Edit: formatting fix. Also, this is of course assuming custom hardware designed for a specific hash function isn't employed.