0
$\begingroup$

I'm just curious about why brute force takes so much longer on the Whirlpool hash than it does on the others, as you will see below:

Passcovery Suite Version 3.50 build 3653 x64
Benchmark
CPU [Intel(R) Core(TM) i3-5020U CPU @ 2.20GHz]

Type: Microsoft® Word 2007
Protection: MS Office 2007, SHA1, 256-bit AES
Password recovery rate: 427 (453)

Type: OpenOffice v1.1
Protection: OpenOffice, PBKDF2/SHA1, 128-bit Blowfish
Password recovery rate: 10,654 (10,801)

Type: Blackberry 5.x backup
Protection: BlackBerry 5.x backup, PBKDF2/AES
Password recovery rate: 2,072,277 (2,082,185)

Type: WPA Handshake
Protection: WPA-PSK, PBKDF2/SHA1 HMAC/SHA1
Password recovery rate: 1,894 (1,900)

Type: RAR 3.x
Protection: RAR 3.x, SHA1, 128-bit AES
Password recovery rate: 383 (387)

Type: ZIP/Classic
Protection: ZIP proprietary algorithm, 96-bit
Password recovery rate: 26,890,751 (27,047,441)

Type: WinZip/AES
Protection: WinZip/AES, PBKDF2/SHA1, 256-bit AES
Password recovery rate: 12,891 (14,411)

Type: TrueCrypt volume
Protection: TrueCrypt volume header, PBKDF2/SHA-512/AES
Password recovery rate: 2,459 (2,476)

Type: TrueCrypt volume
Protection: TrueCrypt volume header, PBKDF2/RIPEMD-160/AES
Password recovery rate: 617 (627)

Type: TrueCrypt volume
Protection: TrueCrypt volume header, PBKDF2/Whirlpool/AES
Password recovery rate: 295 (302)

Type: Microsoft® Word 97
Protection: MS Office 97-2000, MD5, 40-bit RC4
Password recovery rate: 1,710,477 (1,703,046)

Type: Microsoft® Word 2003
Protection: MS Office XP-2003, SHA1, 128-bit RC4
Password recovery rate: 1,604,502 (1,602,161)

Type: Adobe® PDF
Protection: PDF /R 3, MD5, 128-bit RC4/AES
Password recovery rate: 125,753 (124,652)

Type: Adobe® PDF
Protection: PDF /R 6, SHA-256/384/512, 256-bit AES
Password recovery rate: 561 (563)


CPU frequency measured: 2195 Mhz

Raw results: 427, 10654, 2072277, 1894, 383, 26890751, 12891, 2459, 617, 295, 1710477, 1604502, 125753, 561

Also, one more question:

How much faster can I recover my password (20+ characters) from knowing nothing about it (it's been years since I last used it) using a GPU instead?

$\endgroup$
1
  • $\begingroup$ Note: For password hashing used for verification being slow is important. The current rule-of-thumb is 100ms per hash. This is usually obtained by iteration. There are also password hashing algorithms that are designed to use substantial memory in order to thwart GPUs, a current example is ALGO2. Encryption is a poor method to protect passwords and should be avoided unless absolutely necessary to recover a password. $\endgroup$ – zaph Jan 5 '18 at 14:47
3
$\begingroup$

how much faster can i recover my password (20+ characters) from knowing nothing about it (it's been years since i last used it) using a gpu instead?

According to this benchmark, a single Nvidia Tesla V100 (the best GPU commercially available) will hit 94kH/s on that specific mode (search for 6231 on that page) which is about 300x as fast as your CPU and of course you can just use multiple GPUs. For example on Amazon's cloud services, you can have up to 8 such GPUs per VM.

Note however, if you really used a random 20+ character password, there are at least $2^{94}$ possible passwords (if you have used 20 lower case characters only) and testing this amount of passwords is infeasible (and would require $2^{77}$ GPU-years).

I'm just curious about why bruteforce takes so much longer on the whirlpool hash than it does on the others

This is hard to answer. It may be that not a significant amount of effort has been invested in optimizing the Whirlpool implementations, because it's a somewhat rarely seen hash function. It may be that the huge amounts of table-lookups that Whirlpool apparently requires slow down the operations imensely compared to the register-fitting other hash functions.

$\endgroup$
1
  • 1
    $\begingroup$ Generally random character sequences are not used, rather lists of frequently used passwords order by frequency such as at SecLists. Additionally some cracking software also fuzzes the passwords. $\endgroup$ – zaph Jan 5 '18 at 14:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.