Do not try to write --keyspace yourself

Do not try to write --keyspace yourself - Printable Version

+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Developer (https://hashcat.net/forum/forum-39.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-40.html)
+--- Thread: Do not try to write --keyspace yourself (/thread-7035.html)

Pages: 1 2

Do not try to write --keyspace yourself - atom - 11-21-2017

Keyspace is not the number of words in a wordlist:

Quote:$ wc -l rockyou.txt
14344391 rockyou.txt
$ ./hashcat --keyspace rockyou.txt
14344384

So 14344391 != 14344384.

It's also dynamic when it comes to masks:

Quote:$ ./hashcat --keyspace -a 3 ?a
1
$ ./hashcat --keyspace -a 3 ?a?a
95
$ ./hashcat --keyspace -a 3 ?a?a?a
9025
$ ./hashcat --keyspace -a 3 ?a?a?a?a
857375
$ ./hashcat --keyspace -a 3 ?a?a?a?a?a
81450625

So you think you see the logic? Now this:

Quote:$ ./hashcat --keyspace -a 3 ?a?a?a?a?a?a
81450625
$ ./hashcat --keyspace -a 3 ?a?a?a?a?a?a?a
81450625

It's on a limit? No it's not!

Quote:$ ./hashcat --keyspace -a 3 ?a?a?a?a?a?a?a?a
7737809375

And it changes over time:

v3.6.0:

Quote:$ ./hashcat --keyspace rockyou.txt
14343296

v4.0.x:

Quote:$ ./hashcat --keyspace rockyou.txt
14344384

So 14343296 != 14344384.

The morale of this: Don't try to emulate how it works, just use --keyspace

RE: Do not try to write --keyspace yourself - atom - 11-21-2017

There's another nice example! The hash-mode has also influence:

Quote:$ ./hashcat --keyspace -a 3 ?d?d?d?d?d?d?d?d -m 0
100000
$ ./hashcat --keyspace -a 3 ?d?d?d?d?d?d?d?d -m 400
10000000

RE: Do not try to write --keyspace yourself - atom - 11-21-2017

Here's more crazy stuff. The mask itself can have an influence even if the length does not change:

Quote:$ ./hashcat --keyspace -a 3 ?d?d?d?d?d?d?d?d
100000
$ ./hashcat --keyspace -a 3 ?d?dx?d?d?d?d?d
10000

But not always:

Quote:$ ./hashcat --keyspace -a 3 ?d?d?d?d?d?d?d?d
100000
$ ./hashcat --keyspace -a 3 ?a?d?d?d?d?d?d?d
100000

RE: Do not try to write --keyspace yourself - kiara - 11-21-2017

[Image: gun_emoji.jpg]

RE: Do not try to write --keyspace yourself - sjohnny1972 - 11-23-2017

What is the rationale behind this behavior, just wondering? In the Hashcat help I find: "Show keyspace base:mod values and quit". What is base and mod(ulo)?

When I try with rule expansion the value doesn't increase, I would've guessed otherwise:

Code:
./hashcat64.bin -a 0 -r ../files/best64.rule --keyspace ../files/rockyou.txt

RE: Do not try to write --keyspace yourself - royce - 11-24-2017

For more on the scope and impact of keyspace, see

https://hashcat.net/wiki/doku.php?id=frequently_asked_questions#what_is_a_keyspace

Also, atom: can you speak to what keyspace is actually intended to be used for?

RE: Do not try to write --keyspace yourself - philsmd - 11-24-2017

The output of --keyspace can be used to distribute cracking, i.e. you can use the value from --keyspace and divide it into x chunks (best would be if the chunk size depends on the performance of your individual nodes if they are different) and use the -s/-l parameters for distributed cracking.

RE: Do not try to write --keyspace yourself - undeath - 11-24-2017

"keyspace" in itself seems to be a pretty well-defined word but does not match what hashcat considers "keyspace". Maybe this option should be renamed to something more fitting.

RE: Do not try to write --keyspace yourself - royce - 11-24-2017

*lightbulb*

Ahhhh ... so they only need to be "proportional" within specific attack type/combos, and that's why they can't be compared across them! Because it's *called* a keyspace ... but it isn't really strictly an actual keyspace in the literal sense, just a way to divide up work within that attack.

(Hmm ... so in retrospect, using word other than "keyspace" (which means something specific in the general cracking context to most users) would have probably been better -- maybe "workset" or something like that). [Edit: yeah, what undeath said Wink

]

Now I finally get it. Thanks!

RE: Do not try to write --keyspace yourself - evilmog - 11-25-2017

(11-24-2017, 11:00 AM)royce Wrote: *lightbulb*

Ahhhh ... so they only need to be "proportional" within specific attack type/combos, and that's why they can't be compared across them! Because it's *called* a keyspace ... but it isn't really strictly an actual keyspace in the literal sense, just a way to divide up work within that attack.

(Hmm ... so in retrospect, using word other than "keyspace" (which means something specific in the general cracking context to most users) would have probably been better -- maybe "workset" or something like that). [Edit: yeah, what undeath said ]

Now I finally get it. Thanks!

Please don't change --keyspace, hashtopussy, hashtopus, hashview all use it for distribution as does my skip and limit calculator.

Do you want me to do a writeup on how the distribution works?