WPA2 Speed drops by 5x

[10fi]

Hi,

I have an issue with unjustified speed drops. Usually for WPA2 I have nice speeds, around 176 kH/s.

I wanted to try hybrid dictonary + 3 digits:

Code:

cudaHashcat64.exe -a 6 -m 2500 --session=all --status --status-timer=60 -o "z:\1.txt" --outfile-format=3 -w 3 --gpu-temp-abort=80 ".hccap" "words.txt" ?d?d?d

Which results in nice speeds:

Code:

Hash.Type......: WPA/WPA2
Time.Started...: Tue Jan 27 00:24:13 2015 (4 mins, 2 secs)
Time.Estimated.: Tue Jan 27 00:33:58 2015 (5 mins, 42 secs)
Speed.GPU.#1...:   176.5 kH/s
Recovered......: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.......: 49624896/109861000 (45.17%)
Skipped........: 0/49624896 (0.00%)
Rejected.......: 6920000/49624896 (13.94%)
HWMon.GPU.#1...: 99% Util, 72c Temp, N/A Fan

Now by just changing the order (?d?d?d + dictionary) I get 5 times slower speed:

Code:

cudaHashcat64.exe -a 7 -m 2500 --session=all --status --status-timer=60 -o "z:\1.txt" --outfile-format=3 -w 3 --gpu-temp-abort=80 ".hccap" ?d?d?d "words.txt"

Code:

Hash.Type......: WPA/WPA2
Time.Started...: Tue Jan 27 00:34:54 2015 (22 secs)
Time.Estimated.: Tue Jan 27 01:33:53 2015 (58 mins, 36 secs)
Speed.GPU.#1...:    32209 H/s
Recovered......: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.......: 847736/109861000 (0.77%)
Skipped........: 0/847736 (0.00%)
Rejected.......: 127412/847736 (15.03%)
HWMon.GPU.#1...: 93% Util, 61c Temp, N/A Fan

Few facts:

- the speed is almost constant for both cases, testes that a couple of times
- same input is used for both cases, however changing dict and hccap file changes nothing at all
- the gpu utilization is ~93% not ~99% as usual (per MSI afterburner) for the second, slower variant - indicating some issues with feeding the gpu with data
- running windows + cudahashcat 1.31 + hashcatGUI 0.44
- newest drivers
- the wordlist is on SSHD
- GPU temp is at relaxed 60 C
- neither the SSHD nor CPU/memory seem to be bothered in anyway
My humble question:

Why shift from dict+mask to mask+dict caused such a decrease in speed?

[epixoip]

Left keyspace is too small.

[10fi]

Left keyspace is too small.

What the "left key space" is ? I didn't catch it. Could you please elaborate and let me know how to tackle that?

[epixoip]

The attack is not well-structured for GPU acceleration. The keyspace for the left side of your attack is too small, and therefore you will not achieve any GPU acceleration. You can optimize this attack for GPU by using prepend rules instead of hybrid attack.

[atom]

If you switch to oclHashcat v1.32 this will not happen anymore. It will use the wordlist as base whetever -a you choose in hybrid mode.

[10fi]

@epixoip:

Kind thanks! It looks like I will have to read a couple of arts about optimization. Still, given what you said - "the left side of your attack is too small" - I'm a bit surprised that ?d?d (two digits) give the speed of >170 kH/s, same for ?d?d?d?d, but ?d?d?d gives me ~20%.

@atom:

Kind thanks, will try that out.