4
$\begingroup$

I have been playing around with cRARk and was astonished by the low speed. On a 2015 high-end GPU (GeForce 980 ti), it took roughly 4h 50min to test all passwords composed of an 8-character prefix and 6 small latin alphabet letters (AAABBBCC $a * in the format cRARk uses). This is just over 300 million passwords, which corresponds to 18500 passwords per second.

The RAR file is 164 bytes long and has the identification string:

52 61 72 21 1a 07 00

Is it hardware limitation (I've had performance problem with the GPU), is it that cRARk is slow or is it the nature of RAR archives that they are this slow to crack?

Improve this question
$\endgroup$
6
  • $\begingroup$ What's the version of the RAR archive? If it is one of the latest it seems that the passwords are protected by PBKDF2. That function is deliberately slow. $\endgroup$
    – Maarten Bodewes ♦
    Commented Jul 24, 2016 at 23:29
  • $\begingroup$ I don't really know how to answer that, but I'm using the latest WinRar (5.31) and the archive type is is "RAR" (not "RAR5", which is also available). $\endgroup$
    – Wojciech Sidor
    Commented Jul 25, 2016 at 5:31
  • $\begingroup$ Well, can't you look at the header of the RAR archive? Maybe the GNU file command knows? $\endgroup$
    – Maarten Bodewes ♦
    Commented Jul 25, 2016 at 7:41
  • $\begingroup$ that sounds reasonable on a single core app on modern hardware. GPU cards with cuda (like the titan family) can do millions if not billions per second. It can brute force all 7 char combos in seconds. $\endgroup$
    – dandavis
    Commented Jul 25, 2016 at 17:33
  • $\begingroup$ @MaartenBodewes file only says "RAR archive data, vb8," and the first line of hexdump -C test1.rar is 00000000 52 61 72 21 1a 07 00 ce 99 73 80 00 0d 00 00 00 |Rar!.....s......| @dandavis well, it still needs to check if the password matches the archive $\endgroup$
    – Wojciech Sidor
    Commented Jul 25, 2016 at 22:44

2 Answers 2

Reset to default
2
$\begingroup$

Your file is in "RAR4" format (alternatively called 2.9). This means it is not using PBKDF2 as version 5 is, but it still uses an iterative hash. A custom one based on SHA-1, with $2^{14}$ "iterations" each feeding some amount of data into SHA-1. Depending on the length of the password and whether a salt is used, this may not correspond exactly to $2^{14}$ iterations of the SHA-1 compression function.

Assuming a one-to-one correspondence between iterations and SHA-1, your 185000 passwords per second corresponds to about 300 million SHA-1 hashes per second. According to what I can find online (e.g. this), the raw SHA-1 hash rate of your GPU should be about 10x that, but considering the somewhat special structure of the RAR hashing function, it is not obvious that it should reach that, especially with all password/salt lengths.

I.e. your result is not unreasonable, though there may be room to push it further by a factor of ten or so if the hardware is problematic or the software poorly optimized.

(There is no public format definition for RAR formats before 5.0. The above is based on reading the proprietary, but freely available UnRAR source.)

Improve this answer
$\endgroup$
0
$\begingroup$

I'm experimenting using ZLUDA to see how much of my GPU and CPU it will use and speeds atm. curious of results? Zluda is normally meant for image generation, but it takes CUDA and lets AMD gpu's run Geforce-intended software. Right now im getting 499/s-505/s without ZLUDA running underneath it.

Improve this answer
$\endgroup$
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.