Speed difference between brute and dictionary for very slow hashes (7-zip) ?

[marpolo]

Hi!

Why there is so big difference between bruteforce attack mode and dictionary attack mode exist for very slow algorithms ?
Particular I mean 7-zip hash calculation.

My GTX750 is able to get 1049 H/s in bruteforce and 210 H/s in dictionary.

I read all involved wiki topics:
"How to create more work for full speed?"
"Why is my attack so slow?"
"Why does hashcat says it has only 2% GPU utilization?"

There is some explanation for fast (md5 - many MH/s) and slow (scrypt - many kH/s).
But what is wrong with very slow 7-zip hash (several hundreds H/s) ?

There is almost none traffic for 7-zip, just around 100 kB/s, isn't it ?
GPU is utilized 100% and produce only 210 H/s (5 ms period).
PCIe delays is about 5 - 10 us. So delays are 1000 times lower.

Is there any pipeline block in 7-zip hash calculation?
Speed difference is equal 5 times (1049/210). So maybe there is 5-stage pipeline which could not work with dictionary attack ?

I'm not saying that this is good or bad.
Just want to know a some technical details about why this happens, if possible of couse.

Thanks a lot!

[atom]

That's only for the 7-Zip algorithm because the password length has a large influence on the cracking speed. Or said a different way, there's no difference between BF and Dictionary if your BF mask is larger.

[marpolo]

Hi!

Thank you! You give me an excellent tip!

Yes 7-zip hash calculation speed is lower for password with higher length.
I measured such numbers on my GTX750:

Code:

Passwords with 4 letters - 1480 H/s
Passwords with 5 letters - 1300 H/s
Passwords with 6 letters - 1190 H/s
Passwords with 7 letters - 1120 H/s
Passwords with 8 letters - 1060 H/s
Passwords with 9 letters - 940 H/s
Passwords with 10 letters - 880 H/s
...
Passwords with 29 letters - 435 H/s
...

In above example wordlist contains only words with the same length.

But if wordlist contains words with different length hashcat will have significant speed drop!

For wordlist pattern like this:

Code:

a
aa
...
aaaaaaaaaaaaaaaaaaaa (20)
a
aa
...
aaaaaaaaaaaaaaaaaaaa (20)

Speed is only 206 H/s.

So wordlist sorted by password length has around x2-5 speedup as opposed to wordlist sorted by alphabetical order!



Thanks a lot!