EAP-MD5 password extraction

[dono]

Thanks for a quick reply after all these years. Perhaps even with the latest hardware brute forcing is a no go in the end. Do you recall what made you choose a 14 digits for the password ?

At long last I cracked it. Ultimately I had to give up brute forcing it with hashcat. I extracted the data from the ROM chips and reversed the password. It was a 15 character substring derived from the MD5 hash of a fixed string prefix and postfix surrounding interface MAC address (lower case, no colons).