Skip to main content
Cryptography

Return to Answer

added 247 characters in body
Source Link
otus
otus
  • 32.4k
  • 5
  • 73
  • 167

Your file is in "RAR4" format (alternatively called 2.9). This means it is not using PBKDF2 as version 5 is, but it still uses an iterative hash. A custom one based on SHA-1, with $2^{14}$ "iterations" each feeding some amount of data into SHA-1. Depending on the length of the password and whether a salt is used, this may not correspond exactly to $2^{14}$ iterations of the SHA-1 compression function.

Assuming a one-to-one correspondence between iterations and SHA-1, your 185000 passwords per second corresponds to about 300 million SHA-1 hashes per second. According to what I can find online (e.g. this), the raw SHA-1 hash rate of your GPU should be about 10x that, but considering the somewhat special structure of the RAR hashing function, it is not obvious that it should reach that, especially with all password/salt lengths.

I.e. your result is not unreasonable, though there may be room to push it further by a factor of ten or so if the hardware is problematic or the software poorly optimized.

(There is no public format definition for RAR formats before 5.0. The above is based on reading the proprietary, but freely available UnRAR source.)

Your file is in "RAR4" format (alternatively called 2.9). This means it is not using PBKDF2 as version 5 is, but it still uses an iterative hash. A custom one based on SHA-1, with $2^{14}$ "iterations" each feeding some amount of data into SHA-1. Depending on the length of the password and whether a salt is used, this may not correspond exactly to $2^{14}$ iterations of the SHA-1 compression function.

Assuming a one-to-one correspondence between iterations and SHA-1, your 185000 passwords per second corresponds to about 300 million SHA-1 hashes per second. According to what I can find online (e.g. this), the raw SHA-1 hash rate of your GPU should be about 10x that, but considering the somewhat special structure of the RAR hashing function, it is not obvious that it should reach that, especially with all password/salt lengths.

I.e. your result is not unreasonable, though there may be room to push it further by a factor of ten or so if the hardware is problematic or the software poorly optimized.

Your file is in "RAR4" format (alternatively called 2.9). This means it is not using PBKDF2 as version 5 is, but it still uses an iterative hash. A custom one based on SHA-1, with $2^{14}$ "iterations" each feeding some amount of data into SHA-1. Depending on the length of the password and whether a salt is used, this may not correspond exactly to $2^{14}$ iterations of the SHA-1 compression function.

Assuming a one-to-one correspondence between iterations and SHA-1, your 185000 passwords per second corresponds to about 300 million SHA-1 hashes per second. According to what I can find online (e.g. this), the raw SHA-1 hash rate of your GPU should be about 10x that, but considering the somewhat special structure of the RAR hashing function, it is not obvious that it should reach that, especially with all password/salt lengths.

I.e. your result is not unreasonable, though there may be room to push it further by a factor of ten or so if the hardware is problematic or the software poorly optimized.

(There is no public format definition for RAR formats before 5.0. The above is based on reading the proprietary, but freely available UnRAR source.)

Post Undeleted by otus
Post Deleted by otus
Source Link
otus
otus
  • 32.4k
  • 5
  • 73
  • 167

Your file is in "RAR4" format (alternatively called 2.9). This means it is not using PBKDF2 as version 5 is, but it still uses an iterative hash. A custom one based on SHA-1, with $2^{14}$ "iterations" each feeding some amount of data into SHA-1. Depending on the length of the password and whether a salt is used, this may not correspond exactly to $2^{14}$ iterations of the SHA-1 compression function.

Assuming a one-to-one correspondence between iterations and SHA-1, your 185000 passwords per second corresponds to about 300 million SHA-1 hashes per second. According to what I can find online (e.g. this), the raw SHA-1 hash rate of your GPU should be about 10x that, but considering the somewhat special structure of the RAR hashing function, it is not obvious that it should reach that, especially with all password/salt lengths.

I.e. your result is not unreasonable, though there may be room to push it further by a factor of ten or so if the hardware is problematic or the software poorly optimized.