1. Fork/Join framework Rainbow attack example Philip Savkinphilip.savkin@gmail.com Twitter: philipsavkin

2. Fork Join Framework Java framework for supporting a style of parallel programming in which problems are solved by (recursively) splitting them into subtasks that are solved in parallel, waiting for them to complete, and then composing results. http://gee.cs.oswego.edu/dl/papers/fj.pdf

3. Algorithm Result solve(Problem problem) { if (problem is small) directly solve problem else { split problem into independent parts fork new subtasks to solve each part join all subtasks compose result from subresults } }

4. Core classes

5. Differences from ThreadPoolExecutor Suited for recursive tasks and “divide and conquer” algorithms Work stealing

6. Work Stealing Initial state Wait for all threads to complete their tasks

7. Work Stealing Other threads are idle until the first thread finished Wait for all threads to complete their tasks

8. Part II

9. Practical example Passwords are rarely kept in cleartext nowadays The problem: restore passwords from a list of password hashes with Rainbow attack

10. Rainbow attack http://en.wikipedia.org/wiki/Rainbow_attack Build a Rainbow table using the list of possible passwords Lookup passwords in the table

11. The algorithm Load top 2000 english words Add all case permutations Add numbers 0-9 Results in 6 000 000 combinations Compute hashes Lookup hashes in the table

12. How ForkJoin can help? CPU intensive tasks Generate the list of all possible passwords Compute hashes

13. Let’s see some code!

14. Test results Tested on Amazon EC2 Extra Large instance running 64 bit AMI Linux 15 Gb RAM, 4 processors Rainbow table size: 6 041 508 Input: list of 1000 MD5 hashes Found all 10 passwords

15. Test results

16. Bonus slide - Offtopic Never keep passwords in cleartext! MD5 is a bad choice Always add “salt” to passwords The right way: use Bcrypt!

17. More offtopic The “pastebin” experiment http://pastebin.com/1iL2P0G5 Found one password “a1”

18. Questions Thank you!