4 ms·

NTLM passwords? Meh. An awful benchmark for evaluating modern passwords. Who uses NTLM besides Windows, honestly? (Apparently the person who seemed to have not

NTLM passwords? Meh. An awful benchmark for evaluating modern passwords. Who uses NTLM besides Windows, honestly? (Apparently the person who seemed to have not liked this comment, very quickly, heh) I'd be curious about the timeliness of GPU cracking a 8 character, alphanumerical mixed case password hashed with SHA1?

tptacek 15y ago
Like MD5, SHA1 is designed to be fast. For that matter, so is SHA256, and all the SHA-3 candidate functions. The right way to think about this is that all the strong crypto hash functions are unsuitable for use by themselves as password hashes. Cryptographers have a mechanism for securely turning human-readable text into secret material: key derivation functions. All the modern KDFs are adaptive, meaning that they come with a "pain" dial that you can turn to force attackers to spend more time executing crypto code paths and less time comparing results. You can build decent KDFs out of functions like SHA1, but if hardware GPU cracking is the future, you're best off with something like Colin Percival's "scrypt", which was explicitly designed to be memory-hard (requiring lots of state to compute) and hard to parallelize: http://www.tarsnap.com/scrypt/scrypt-slides.pdf http://www.tarsnap.com/scrypt/scrypt-slides.pdf
- shaggyfrog 15y ago
  I know you're a domain expert and in this thread you've suggested both bcrypt and scrypt. Is there any advantage to one over the other? From my POV it seems that bcrypt has more implementations and seems better-known (in a good way).
  - tptacek 15y ago
    scrypt is the sounder scheme, but bcrypt is far more widely available. Both are fine.
caf 15y ago
NTLM hashes are MD4, which is of a comparable speed to SHA1 for short input blocks, so the time would be around the same. At any rate, you can download ighashgpu and try it for yourself.
- drivebyacct2 15y ago
  Something tells me running ighashgpu through VirtualBox or wine wouldn't be wise.
pauldino 15y ago
According to http://www.golubev.com/hashgpu.htm http://www.golubev.com/hashgpu.htm "Recovery speed on ATI HD 5970 peaks at 5600M/s MD5 hashes and 2300M/s SHA1 hashes." So at peak rates I think that would come out to around 26 hours. Combinations/SHA1HashesPerSecond/SecondsPerHour (26 * 2 + 10) ^ 8 / (2300 * 1000000) / 3600 = 26

tptacek 15y ago

Like MD5, SHA1 is designed to be fast. For that matter, so is SHA256, and all the SHA-3 candidate functions. The right way to think about this is that all the strong crypto hash functions are unsuitable for use by themselves as password hashes. Cryptographers have a mechanism for securely turning human-readable text into secret material: key derivation functions. All the modern KDFs are adaptive, meaning that they come with a "pain" dial that you can turn to force attackers to spend more time executing crypto code paths and less time comparing results. You can build decent KDFs out of functions like SHA1, but if hardware GPU cracking is the future, you're best off with something like Colin Percival's "scrypt", which was explicitly designed to be memory-hard (requiring lots of state to compute) and hard to parallelize: http://www.tarsnap.com/scrypt/scrypt-slides.pdf http://www.tarsnap.com/scrypt/scrypt-slides.pdf

shaggyfrog 15y ago
I know you're a domain expert and in this thread you've suggested both bcrypt and scrypt. Is there any advantage to one over the other? From my POV it seems that bcrypt has more implementations and seems better-known (in a good way).
- tptacek 15y ago
  scrypt is the sounder scheme, but bcrypt is far more widely available. Both are fine.

caf 15y ago

NTLM hashes are MD4, which is of a comparable speed to SHA1 for short input blocks, so the time would be around the same. At any rate, you can download ighashgpu and try it for yourself.

drivebyacct2 15y ago
Something tells me running ighashgpu through VirtualBox or wine wouldn't be wise.

pauldino 15y ago

According to http://www.golubev.com/hashgpu.htm http://www.golubev.com/hashgpu.htm "Recovery speed on ATI HD 5970 peaks at 5600M/s MD5 hashes and 2300M/s SHA1 hashes." So at peak rates I think that would come out to around 26 hours. Combinations/SHA1HashesPerSecond/SecondsPerHour (26 * 2 + 10) ^ 8 / (2300 * 1000000) / 3600 = 26