low performance with prepend more than 3 characters in mask attack

[shadowmourne]

when i run

Code:

cudaHashcat64.bin -a 3 -m 5100 b068322473d98c88 123?a?a?a?a?a?a1111111111155e82da34

i got a crack speed of 519 MH/s.

Code:

Session.Name...: cudaHashcat
Status.........: Running
Input.Mode.....: Mask (123?a?a?a?a?a?a1111111111155e82da34) [29]
Hash.Target....: b068322473d98c88
Hash.Type......: Half MD5
Time.Started...: Mon Sep  7 00:16:29 2015 (4 secs)
Time.Estimated.: Mon Sep  7 00:40:07 2015 (23 mins, 32 secs)
Speed.GPU.#1...:   519.0 MH/s
Recovered......: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.......: 2527723520/735091890625 (0.34%)
Rejected.......: 0/2527723520 (0.00%)
Restore.Point..: 26607616/7737809375 (0.34%)
HWMon.GPU.#1...: -1% Util, 61c Temp, N/A Fan

but if i run

Code:

cudaHashcat64.bin -a 3 -m 5100 b068322473d98c88 1234?a?a?a?a?a?a1111111111155e82da3

the crack speed reduced to 30770 kH/s

Code:

Session.Name...: cudaHashcat
Status.........: Aborted
Input.Mode.....: Mask (1234?a?a?a?a?a?a1111111111155e82da3) [29]
Hash.Target....: b068322473d98c88
Hash.Type......: Half MD5
Time.Started...: Mon Sep  7 00:16:12 2015 (7 secs)
Time.Estimated.: Mon Sep  7 07:32:14 2015 (7 hours, 15 mins)
Speed.GPU.#1...: 30770.1 kH/s
Recovered......: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.......: 218365952/735091890625 (0.03%)
Rejected.......: 0/218365952 (0.00%)
Restore.Point..: 218365952/735091890625 (0.03%)
HWMon.GPU.#1...: -1% Util, 54c Temp, N/A Fan

is this a bug or something?

[rico]

I was wondering about this myself. I was playing with NTLM (-m 1000) a couple of nights ago and noticed that prepending even a single character slows the hash rate to ~25% whilst append works the same, e.g.

Straight mask = 13,500 MH/s:

oclHashcat64 -m 1000 -a 3 hash.txt ?l?l?l?l?l?d?d?d?d?d?d?d
oclHashcat v1.37 starting...

Device #1: Cypress, 1024MB, 735Mhz, 20MCU
Device #2: Cypress, 1024MB, 735Mhz, 20MCU

Hash.Type......: NTLMSpeed.
GPU.#1...:  6735.8 MH/s
Speed.GPU.#2...:  6772.5 MH/s
Speed.GPU.#*...: 13508.3 MH/s

Prepend a character (replace first ?l) = 3,400 MH/s:

oclHashcat64 -m 1000 -a 3 hash.txt n?l?l?l?l?d?d?d?d?d?d?d

Hash.Type......: NTLM
Speed.GPU.#1...:  1691.8 MH/s
Speed.GPU.#2...:  1725.2 MH/s
Speed.GPU.#*...:  3417.0 MH/s

Append append a digit (replace last ?d) = 13,586 MH/s:

oclhashcat64 -m 1000 -a 3 hash.txt ?l?l?l?l?l?d?d?d?d?d?d7

Hash.Type......: NTLM
Speed.GPU.#1...:  6771.4 MH/s
Speed.GPU.#2...:  6815.0 MH/s
Speed.GPU.#*...: 13586.3 MH/s

For reference, this same card benches at 16877.9 MH/s. Yes, I know about tweaking -n and -u but the issue remains either way.

EDIT: cudaHashcat64 does the same thing on a GTX 760 (3607.4 MH/s vs 1020.4 MH/s = ~28% performance).

[FlippingGerman]

The rule engine was designed for CPU and is (apparently) not nearly so good on GPU.
As for a brute-force, I have the same problem, GPU benches at ~ 1400 MH/s MD5 but only does less than half that in practice. I thought about it for a while; I think it's because benchmark is single-hash and most things you'll have done there are likely not. Especially if they're password dumps, they can be thousands or millions.

[epixoip]

Benchmark mode performs a single hash brute force of a large keyspace, an ideal scenario that presents the opportunity for maximum optimization. Many of the optimizations are not applicable when attacking multiple hashes or using other attack modes.

The reason why replacing ?l with the single character "n" results in dramatically lower speed is that the left side of the mask is now too small to gain full acceleration.

[shadowmourne]

The reason why replacing ?l with the single character "n" results in dramatically lower speed is that the left side of the mask is now too small to gain full acceleration.

but add a character 'n' to the left of original mask also reduce the speed to nearly 28%.

cudaHashcat64.bin  -m 1000 -a 3 b4b9b02e6f09a9bd760f388b67351e2b ?l?l?l?l?l?d?d?d?d?d?d?d
cudaHashcat v1.37 starting...
Device #1: GeForce GTX 680M, 2039MB, 758Mhz, 7MCU

Session.Name...: cudaHashcat
Status.........: Running
Input.Mode.....: Mask (?l?l?l?l?l?d?d?d?d?d?d?d) [12]
Hash.Target....: b4b9b02e6f09a9bd760f388b67351e2b
Hash.Type......: NTLM
Time.Started...: Mon Sep  7 13:11:25 2015 (9 secs)
Time.Estimated.: Tue Sep  8 01:34:53 2015 (12 hours, 23 mins)
Speed.GPU.#1...:  2667.3 MH/s

cudaHashcat64.bin  -m 1000 -a 3 b4b9b02e6f09a9bd760f388b67351e2b n?l?l?l?l?l?d?d?d?d?d?d?d
cudaHashcat v1.37 starting...
Device #1: GeForce GTX 680M, 2039MB, 758Mhz, 7MCU

Session.Name...: cudaHashcat
Status.........: Running
Input.Mode.....: Mask (n?l?l?l?l?l?d?d?d?d?d?d?d) [13]
Hash.Target....: b4b9b02e6f09a9bd760f388b67351e2b
Hash.Type......: NTLM
Time.Started...: Mon Sep  7 13:11:41 2015 (5 secs)
Time.Estimated.: Wed Sep  9 10:36:18 2015 (1 day, 21 hours)
Speed.GPU.#1...:   735.4 MH/s

[epixoip]

Of course, it has the exact same effect.