Hash recipes

A hash recipe describes a hashing scheme on the command line, and hashcat compiles it into a GPU kernel at startup. It is attack mode independent and runs as hash-mode -m 4000:

$ hashcat -m 4000 --hash-recipe 'md5(md5(salt) . pass)' hash.txt wordlist.txt

Use a recipe for a scheme that no hash-mode covers. Before recipes, the options were to write a plugin with its kernels or fall back to a much slower generic one.

A recipe is compiled, not interpreted, so it runs at kernel speed. On a Radeon Pro W7800 recipes in straight and brute-force attacks land within 1 to 5 percent of the native kernels, and some are quicker: hmac_sha256(salt, pass) runs at 7.67 GH/s on an RTX 4090 against 4.71 GH/s for the native pure kernel of mode 1460.

Recipes use hx, the hash expression language. In outline:

• the usual hash functions, MD4, MD5, SHA-1, SHA-2, SHA-3, Keccak, RIPEMD, BLAKE2, SM3, Whirlpool, Streebog and more, most with an HMAC form
• PBKDF2, AES and DES, to derive keys and to encrypt, decrypt or unwrap
• transforms such as upper, rev and pad on the password, the salt, the digest and derived values
• salts held as hex or base64, and digests sliced or re-encoded
• a second salt, a pepper and the user name, read from the hash line
• variables, loops and bitwise operations across several statements

Mode 4000 compiles 903 of the 1005 expressions in the hx catalogue.

--dynamic-x reads the format out of a $dynamic_N$ hash and picks the matching recipe, so neither -m nor --hash-recipe is needed. It covers 407 of the 409 dynamic formats built into John the Ripper, and all 58 in its dynamic.conf. Only phpass and HTTP digest authentication are left out.

• docs/hashcat-hash-recipe.md is the reference and ships in the release folder under docs/