4 ms·

A bit off-topic, but I am currently trying to recover ~$70000 worth of ether[1] from my presale wallet and the encryption used is indeed SHA-3. I'm currently t

by Tenoke 9y ago

A bit off-topic, but I am currently trying to recover ~$70000 worth of ether[1] from my presale wallet and the encryption used is indeed SHA-3. I'm currently trying 21970881 passwords against the hash using fairly basic python code (ETA: 2-3 days), and can definitely use tips for speeding up the work, as Id likely need to try an order of magnitude or 2 more generated password in order to crack it. 1. https://etherchain.org/account/0x35f5860149e4bbc04b8ac5b272be55ad1aca58e0 https://etherchain.org/account/0x35f5860149e4bbc04b8ac5b272b...

webkike 9y ago
It's pretty easy to speed up the process by using multi threaded gpu code.
flipp3r 9y ago
Python? There's tools for this, like oclHashcat/cudaHashcat
esnard 9y ago
You should definitively use hashcat[0]. It's the fastest hashing tool at the moment, and it supports both PBKDF2-HMAC-SHA256 and SCRYPT for Ethereum wallets since the last update. It can test 588 passwords per second on my modest GPU. I guess that's a lot better than a basic Python script. You should also have a look at probable wordlists[1], which contains a lot of passwords sorted by their popularity. It could significantly speedup the research, as long as your password has already leaked elsewhere. [0] https://hashcat.net/hashcat/ https://hashcat.net/hashcat/ [1] https://github.com/berzerk0/Probable-Wordlists https://github.com/berzerk0/Probable-Wordlists
- Tenoke 9y ago
  The password definitely hasn't leaked as it is a one time password I created based on a somewhat complex scheme, but switching to hashcat (as also pointed outby flipp3r) seems to be the best next step.
insomniasexx 9y ago
The encryption actually is KECCAK-256, not SHA-3. However, if you are using a library built for Ethereum it'll be called SHA-3. When Ethereum was being developed, the spec for SHA-3 wasn't finished or something: https://ethereum.stackexchange.com/questions/550/which-cryptographic-hash-function-does-ethereum-use https://ethereum.stackexchange.com/questions/550/which-crypt... It sounds like you have it under control but I typically point people to Dave @ https://walletrecoveryservices.com/ https://walletrecoveryservices.com/ for the less tech-savvy. He's pretty good. You can look at his site for what he can and can't crack. I know he's super super busy but it never hurts to give him a shout and ask him if he has any pro-tips or open-source code somewhere. A ping from someone who has a basic understanding of encryption might be refreshing. Here are a random assortment of links I have saved regarding recovering presales: https://www.reddit.com/r/ethereum/comments/46887p/tips_for_recovering_your_presale_password/ https://www.reddit.com/r/ethereum/comments/46887p/tips_for_r... https://forum.ethereum.org/discussion/3045/request-post-password-instructions-that-were-given-for-the-presale-last-year https://forum.ethereum.org/discussion/3045/request-post-pass... https://www.reddit.com/r/ethereum/comments/3g6aw0/i_lost_my_password_to_my_presale_wallet_admit_it/ https://www.reddit.com/r/ethereum/comments/3g6aw0/i_lost_my_...

by Tenoke 9y ago

webkike 9y ago

It's pretty easy to speed up the process by using multi threaded gpu code.

flipp3r 9y ago

Python? There's tools for this, like oclHashcat/cudaHashcat

esnard 9y ago

You should definitively use hashcat[0]. It's the fastest hashing tool at the moment, and it supports both PBKDF2-HMAC-SHA256 and SCRYPT for Ethereum wallets since the last update. It can test 588 passwords per second on my modest GPU. I guess that's a lot better than a basic Python script. You should also have a look at probable wordlists[1], which contains a lot of passwords sorted by their popularity. It could significantly speedup the research, as long as your password has already leaked elsewhere. [0] https://hashcat.net/hashcat/ https://hashcat.net/hashcat/ [1] https://github.com/berzerk0/Probable-Wordlists https://github.com/berzerk0/Probable-Wordlists

Tenoke 9y ago
The password definitely hasn't leaked as it is a one time password I created based on a somewhat complex scheme, but switching to hashcat (as also pointed outby flipp3r) seems to be the best next step.

insomniasexx 9y ago

The encryption actually is KECCAK-256, not SHA-3. However, if you are using a library built for Ethereum it'll be called SHA-3. When Ethereum was being developed, the spec for SHA-3 wasn't finished or something: https://ethereum.stackexchange.com/questions/550/which-cryptographic-hash-function-does-ethereum-use https://ethereum.stackexchange.com/questions/550/which-crypt... It sounds like you have it under control but I typically point people to Dave @ https://walletrecoveryservices.com/ https://walletrecoveryservices.com/ for the less tech-savvy. He's pretty good. You can look at his site for what he can and can't crack. I know he's super super busy but it never hurts to give him a shout and ask him if he has any pro-tips or open-source code somewhere. A ping from someone who has a basic understanding of encryption might be refreshing. Here are a random assortment of links I have saved regarding recovering presales: https://www.reddit.com/r/ethereum/comments/46887p/tips_for_recovering_your_presale_password/ https://www.reddit.com/r/ethereum/comments/46887p/tips_for_r... https://forum.ethereum.org/discussion/3045/request-post-password-instructions-that-were-given-for-the-presale-last-year https://forum.ethereum.org/discussion/3045/request-post-pass... https://www.reddit.com/r/ethereum/comments/3g6aw0/i_lost_my_password_to_my_presale_wallet_admit_it/ https://www.reddit.com/r/ethereum/comments/3g6aw0/i_lost_my_...