+- hashcat Forum (https://hashcat.net/forum)
+-- Forum: Developer (https://hashcat.net/forum/forum-39.html)
+--- Forum: hashcat (https://hashcat.net/forum/forum-40.html)
+--- Thread: Why is SHA-1 one faster than NetNTLMv1? and two other questions (/thread-6290.html)
Why is SHA-1 one faster than NetNTLMv1? and two other questions - DoNoHarm - 02-11-2017
So to start with I just started learning about hashes and cracking, thus a student rather than professional, so please don't beat me up if these were a stupid questions. Just refer me to where I can read more about them and will do. If you want a short version of questions see the end.
1 - Looking at multiple benchmarks like the one provided by Jeremi here, SHA-1 is slower than NetNTLVMv1-VANILLA / NetNTLMv1+ESS. Even in my computer this is the case too (benchmark). However, it turned out that hashcat will be faster in SHA1 whether I am using masks or dictionary attack with rules. Could someone please explain why is that? Note: regarding the number of hashes: ~600,000 SHA1 and ~1000 NetNTLVMv1-VANILLA / NetNTLMv1+ESS.
2 - My I have two CPUs and two GPUs in the case, and hashcat uses only the GPUs. I can try to make the CPUs also work but I wonder if that would worth the headache when handling NetNTLVMv1-VANILLA / NetNTLMv1+ESS hashes? The GPUs are 1080GTX FE and CPUs are Intel Xeon E5-2630V4 2.20GHZ
3 - Since my primary focus is on NetNTLVMv1-VANILLA / NetNTLMv1+ESS hashes, is there a way to tune hashcat/hardware to crack them faster?
I am not sure if this might be related to the issue but the hashes were originally obtained from a RADIUS server, thus as response/challenge NetNTLMv2, but the RADIUS server gives JTR format and I used this tool to convert the hashes to hashcat compatible format.
Short version: why is SHA1 -m100 faster than NetNTLMv1 -m5500 while in the benchmark it's the opposite? Would integrating my two CPUs make a difference in cracking -m5500? Would any change to hardware enhance cracking -m5500?
RE: Why is SHA-1 one faster than NetNTLMv1? and two other questions - epixoip - 02-11-2017
Your 600k SHA1 are unsalted, whereas NetNTLMv1 is salted. You will incur a 1000x slowdown with 1000 salts.
RE: Why is SHA-1 one faster than NetNTLMv1? and two other questions - DoNoHarm - 02-16-2017
Aha! Thanks Jeremi this makes perfect sense! Although now I feel a bit stupid realizing that I should've done more reading about the algorithm before jumping to cracking.