Calculating --keyspace for attack mode 1

[hannhimhe]

I've read a couple of other threads about how oclHashcat calculates --keyspace. So I am aware not everything that looks like a bug is a bug but "the deep workings of oclHashcat". I have however not seen any threads about attack mode 1, combinator.

hashcat\oclHashcat32.exe -m 0 -a 0 hashlists\2 files\alla.dic --keyspace
41756867

hashcat\oclHashcat32.exe -m 0 -a 1 hashlists\2 files\alla.dic files\alla.dic --keyspace
41756867

Shouldn't the keyspace for -a 1 be ~41756867^41756867?

[epixoip]

Ah, welcome to the joy of "real keyspace" vs "oclhashcat keyspace."

The real keyspace would be 41756867 * 41756867 = 1743635941655689, since each word from dict 2 is appended to each word from dict 1.

However, oclHashcat works a bit differently since we're talking about GPUs. You have a base loop, which runs on the CPU and dispatches work to the GPUs, and you have a modifier loop, which is what is run on the GPU. This model is necessary to actually gain GPU acceleration.

So what oclHashcat reports with --keyspace is the keyspace of the base loop only, excluding the keyspace of the modifier loop.

So with -a 1, the keyspace of the base loop is the keyspace of the left dictionary, and the keyspace of the modifier loop is the keyspace of the right dictionary. For -s/-l purposes oclHashcat only cares about the base loop, so what is reported with --keyspace is the keyspace of the left dictionary.

[hannhimhe]

Thank you!

I use it with -s/-l in a distributed setup. With -a 0 a two hour chunk is ~two hours. In -a 1...a lot more.

On the other hand it is not a big problem to solve. I'll calculate keyspace on the server and adjust chunk size accordingly.

[epixoip]

Right. Distributing CPU workload is easy because you have the actual literal keyspace and can simply divide it up as appropriate and this is consistent for all attack modes. But distributing oclHashcat gets very difficult because the keyspace of the base loop is calculated differently for each attack mode, and the multiplier changes depending on the real keyspace. It took us a little while to work through all of the corner cases in Hashstack and nail down the algorithm for consistently dividing up work. It's very rewarding once you finally figure it out, but it's definitely something you will struggle through.

[hannhimhe]

I'm thick skinned. Should be ok. Thank you for the heads up! Looking forward to a thorny journey.