3 ms·

Does that break more then md5? I thought it was well known that md5 was a bad password hash algorithm.

• jstalin 15y ago
  I don't know why an application couldn't also attack other hashing algorithms. It's just about brute force creating lots of hashes. This app also uses GPUs to brute force TrueCrypt: http://www.golubev.com/igprs/ http://www.golubev.com/igprs/
  • Johngibb 15y ago
    Because algorithms like bcrypt have a computational difficulty parameter. You can dial it up so that every check takes something ridiculous. Now instead of brute forcing all of those possibilities in 10 days, it's 1000 centuries.
  • bluecalm 15y ago
    Hash functions are designed to be fast, to use them in stuff like hash tables, hash structures, checksums etc when the faster the function the better (as long as it doesn't have too many collisions). If you transfer data fast and need a lot of checksums or if you do operations on hash structures your goal is speed. On the other hand with passwords you don't want hash, you want encryption and preferably encryption which is very difficult to calculate as encrypting passwords is rare operation and could take those extra CPU cycles for normal use but which is crucial to make it difficult to crack by brute force. See: http://en.wikipedia.org/wiki/Cryptographic_hash_function http://en.wikipedia.org/wiki/Cryptographic_hash_function Using hash instead of encryption for passwords is major security mistake
• shawabawa 15y ago
  MD5 is bad because it suffers from collision attacks, however it doesn't suffer from preimage attacks, so it's actually fairly secure for passwords (although I still wouldn't use it over any modern algorithm). Basically, you can make 2 arbitrary pieces of data have the same hash, but you can't create a piece of data matching a known hash.