10-15-2016, 10:12 AM
Two notes here:
Approaches that use Markov Models need to be split into two groups. The ones that can work with slow hashes and the ones that can work with both slow and fast hashes. There's only one implementation which can handle both and that's the one implemented in hashcat. Whenever you use a mask in hashcat, you always use a Markov Models based keyspace search optimization unless you use --markov-disable. The first group, the ones that can handle slow hashes only, is more efficient. For example: OMEN. But, they are good for slow hashes only. But then, they are not as a good as a real wordlist attack and if you have a really slow hash like veracrypt there's only a wordlist attack left you can do. That means Markov Models of the first kind becomes more useless the slower the hash is.
And there's those approaches that base on some feedback. But feedback, that make no sense for slow hashes. For example NN. I can't understand how such an paper gets accepted to BH. The NN approach needs a fast hash to be useful. But then, there's no way to implement NN fast enough for a fast hash. So we can't use it for slow hashes and we can't use it for fast hashes. There's nothing left makes this approach a typical theoretical attack which is useless in a real-life scenario.
Also, IPMI2 is a fast hash, not a slow hash.
Approaches that use Markov Models need to be split into two groups. The ones that can work with slow hashes and the ones that can work with both slow and fast hashes. There's only one implementation which can handle both and that's the one implemented in hashcat. Whenever you use a mask in hashcat, you always use a Markov Models based keyspace search optimization unless you use --markov-disable. The first group, the ones that can handle slow hashes only, is more efficient. For example: OMEN. But, they are good for slow hashes only. But then, they are not as a good as a real wordlist attack and if you have a really slow hash like veracrypt there's only a wordlist attack left you can do. That means Markov Models of the first kind becomes more useless the slower the hash is.
And there's those approaches that base on some feedback. But feedback, that make no sense for slow hashes. For example NN. I can't understand how such an paper gets accepted to BH. The NN approach needs a fast hash to be useful. But then, there's no way to implement NN fast enough for a fast hash. So we can't use it for slow hashes and we can't use it for fast hashes. There's nothing left makes this approach a typical theoretical attack which is useless in a real-life scenario.
Also, IPMI2 is a fast hash, not a slow hash.