BCrypt + GTX670 = 6 c/s?

[wflme]

Hello Anton,

What atom meant is that attack depends on the number of hashes you are trying to attack (this correlation is linear, e.g attacking 5 hashes will yield 1/5 of the attack speed).

Another reason for the slow speed could be the iterations count which is "embedded" in the hash string. I guess you could post the hash prefix and that's not against the forum rules, but basically the bcrypt hashes look like:

$2$<iterations>$<salt>$<base64-encoded hash>

The common hashes have "5" for iterations (which actually means 2^5=32), so they start with $2$05$

However some implementations might increase the iterations count.

Keep in mind that bcrypt is quite an anti-GPU algorithm as it requires a lot of memory accesses. A mid-end CPU would often crack it faster as compared to a high-end GPU.

Hello gat3way and thanks for an in-depth reply.

I do (or so I hope) understand the premise, but real-life tests (as per my previous post with just one hash) make no difference at all.

The hash in question starts with $2a$12$. I'm not sure what to make of it, bcrypt-wise, since I never dealt with it before. Looking at that 12 pretty much means I'm f*cked, do I understand this correctly? And you have a single-digit number before the first separator (yours is $2$, mine is $2a$), does that account for anything?

I'm pretty much alright on the memory front with 32GB of RAM and the latest 3.6ghz i7. Or so I thought.

Anyway, thanks again. That was enlightening.

Anton.

[epixoip]

Edit: would try to run it through the bruteforce, but for the life of me I can't figure the exact syntax, as opposed to oclHashcat-lite. Tried everything by the book (i.e., --help), it still expects input from stdin. But could we PLEASE make the command line options between two similar programs somewhat alike? I do hope that at one glorious moment of time you'll merge those three with a uniform syntax. Unless I'm missing a point.

The syntax is already uniform. The only thing that you are missing is the attack mode (-a 3). Since oclHashcat-lite only supports one attack mode, it does not need a parameter to tell it to do a mask attack. But since oclHashcat-plus supports multiple attack modes, you have to tell it which attack mode you want.

Most everything else is the same between all three programs.

[epixoip]

The hash in question starts with $2a$12$. I'm not sure what to make of it, bcrypt-wise, since I never dealt with it before. Looking at that 12 pretty much means I'm f*cked, do I understand this correctly?

wow, the cost parameter is 12!? that's excessive, but certainly explains the slow speed. that means it is doing 4096 iterations, versus the 32 iterations that we benchmark against.

[wflme]

wow, the cost parameter is 12!? that's excessive, but certainly explains the slow speed. that means it is doing 4096 iterations, versus the 32 iterations that we benchmark against.

So yet again, I'm royally fucked, am I?

Also, any idea what kind of processing power does it take to encrypt it for thousands of users and if it's that easy, why is everyone still using (possibly salted) md5? Okay, because CMS and commercial software. Why don't they?

I do remember the UNIX transfer from world-readable /etc/passwd with DES encrypted passwords (no concept of /etc/shadow back then. Kerberos). Then they moved to /etc/shadow and still used DES. Then we learned that MD5 is not much better than DES.

Then I stopped being a UNIX sysadmin.

Besides the point, but felt like contributing. Yay.

[Rolf]

So yet again, I'm royally fucked, am I?

Kinda.
If you buy several 7970s, you would get 100~150 c/s.
Don't forget, the NV 6xx GPUs are meant for games, not compute, so using 580s or 590s would yield more speed.
Still, AMD gpus are better at this.

[wflme]

So yet again, I'm royally fucked, am I?

Kinda.
If you buy several 7970s, you would get 100~150 c/s.
Don't forget, the NV 6xx GPUs are meant for games, not compute, so using 580s or 590s would yield more speed.
Still, AMD gpus are better at this.

Comrade Rolf,

I believe you've made it plausible plenty enough. Won't be buying no MD5 cracking motherfuckers. I'm still 31 and sometimes I do play. So no ATI whatsoever.

As for the games, since it's been brought up, I don't see any games worth a $2k purchase just for the case. Then again, I digress.

So the consensus is: I won't be cracking those hashes anytime soon. Right?

[radix]

Well, its not impossible, you just need to do some research. Tailor your wordlists to things that they will most likely be. Try on CPU. bcrypt is it really bad on GPU.

[wflme]

Well, its not impossible, you just need to do some research. Tailor your wordlists to things that they will most likely be. Try on CPU. bcrypt is it really bad on GPU.

No, I'd rather take a 1.0mg of Fuckitall..

T'was a training exercise in a way, too.

[wflme]

As in, how soon we take on that fucken foreigner who can't understand basic English crying at him

[wflme]

I'm not British either. Nobody ever tried beat me up.

Do let them.

I spent I don't quite remember how many what.