OK, I have a shadow file with a password that I know, it is 4 letters followed by two numbers. Using John The Ripper with OpenCL support, on a laptop with AMD Radeon Mobility graphics, how long would it take to brute-force it? What speed should I expect?
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
The simplest and obvious solution is to just do it. JTR (or any decent password cracker) will show a realtime ETC and this is much better than speculating endlessly about hardware specifications.
But if you must, read on...
This is highly dependent on the number of iterations you used for the KDF. But you can calculate it easily. Suppose selecting one candidate and running it through sha512crypt takes time $t$.
Now there are 52 "letters" in the alphabet (I assume case matters) and 10 "numbers". So there are, in total, $52^4 \cdot 10^2 = 731161600$ candidates for your password.
Thus, on a single core, you will need $731161600 t$ units of time in the worst case to find your password. On average, it will take $\frac{731161600}{2} t$ units of time.
Now if you have $k$ different cores to work with, you will on average find the password after:
$$\frac{731161600}{2} \frac{t}{k} ~ ~ ~ ~ (\text{units of time} ~ t)$$
Let's plug in some numbers. A mainstream GPU has quite a lot of independent execution units, so let's say $k = 256$, a reasonable number. On the CPU, let's say you set up your KDF properly and it takes 0.1 seconds to compute it on the CPU. The GPU cores are slower individually, so let $t = 0.25 ~ \text{s}$.
$$\text{Average time to crack} = \frac{731161600}{2} \frac{0.25 ~ \text{s}}{256} = 357000 ~ \text{s}$$
Which comes out at around four days on average. In the worst case, it will take eight days.
Select $t$ and $k$ accordingly (I suspect in your case, your $k$ will be lower since you have a laptop graphics card, but your $t$ may also be lower). On specialized hardware, it would be faster, of course.
If worst comes to worst, you can always loan a few heavy-duty servers (or ask friends) and increase your $k$ value considerably, which can speed up the process quite a bit.
tl;dr it depends on how fast your GPU is, and how you configured your sha512crypt KDF. And if you have any additional information on the password (is the first letter a vowel, are the four letters a word, etc..) you can use this to set up rules in JTR to reduce the number of possible candidates.
