Bcrypt at 25: A Retrospective on Password Security | USENIX

Interesting read on various ways to secure password hashes and how Bcrypt has stayed relevant for an incredible 25 years. I found this bit about the design intentionally making it more difficult to use GPU methods interesting.

We designed the adaptable work factor in bcrypt, primarily to keep pace with increasing CPU performance, but also included factors to make it more robust against custom ASICs or GPU acceleration, e.g. by heavily relying on instructions that generic CPUs execute efficiently. A crucial aspect of bcrypt's resistance to GPU optimization lies in its memory access pattern spanning 4KB during the key setup phase, which is inefficient to parallelize on GPUs with small L1 caches (Malvoni et al., 2014). That said, NVidia increased the L1 cache significantly to 16MB for the RTX 4090 and bcrypt’s 4KB is a tiny amount of memory these days.

Good passwords with a good hash and a strong second factor are pretty hard to get by, even today.