# Why is password recovery so slow for Whirlpool hash, when compared with others?

I'm just curious about why brute force takes so much longer on the Whirlpool hash than it does on the others, as you will see below:

Passcovery Suite Version 3.50 build 3653 x64
Benchmark
CPU [Intel(R) Core(TM) i3-5020U CPU @ 2.20GHz]

Type: Microsoft® Word 2007
Protection: MS Office 2007, SHA1, 256-bit AES

Type: OpenOffice v1.1
Protection: OpenOffice, PBKDF2/SHA1, 128-bit Blowfish

Type: Blackberry 5.x backup
Protection: BlackBerry 5.x backup, PBKDF2/AES

Type: WPA Handshake
Protection: WPA-PSK, PBKDF2/SHA1 HMAC/SHA1

Type: RAR 3.x
Protection: RAR 3.x, SHA1, 128-bit AES

Type: ZIP/Classic
Protection: ZIP proprietary algorithm, 96-bit

Type: WinZip/AES
Protection: WinZip/AES, PBKDF2/SHA1, 256-bit AES

Type: TrueCrypt volume

Type: TrueCrypt volume

Type: TrueCrypt volume

Type: Microsoft® Word 97
Protection: MS Office 97-2000, MD5, 40-bit RC4

Type: Microsoft® Word 2003
Protection: MS Office XP-2003, SHA1, 128-bit RC4

Protection: PDF /R 3, MD5, 128-bit RC4/AES

Protection: PDF /R 6, SHA-256/384/512, 256-bit AES

CPU frequency measured: 2195 Mhz

Raw results: 427, 10654, 2072277, 1894, 383, 26890751, 12891, 2459, 617, 295, 1710477, 1604502, 125753, 561


Also, one more question:

How much faster can I recover my password (20+ characters) from knowing nothing about it (it's been years since I last used it) using a GPU instead?

• Note: For password hashing used for verification being slow is important. The current rule-of-thumb is 100ms per hash. This is usually obtained by iteration. There are also password hashing algorithms that are designed to use substantial memory in order to thwart GPUs, a current example is ALGO2. Encryption is a poor method to protect passwords and should be avoided unless absolutely necessary to recover a password. – zaph Jan 5 '18 at 14:47

how much faster can i recover my password (20+ characters) from knowing nothing about it (it's been years since i last used it) using a gpu instead?

According to this benchmark, a single Nvidia Tesla V100 (the best GPU commercially available) will hit 94kH/s on that specific mode (search for 6231 on that page) which is about 300x as fast as your CPU and of course you can just use multiple GPUs. For example on Amazon's cloud services, you can have up to 8 such GPUs per VM.

Note however, if you really used a random 20+ character password, there are at least $2^{94}$ possible passwords (if you have used 20 lower case characters only) and testing this amount of passwords is infeasible (and would require $2^{77}$ GPU-years).

I'm just curious about why bruteforce takes so much longer on the whirlpool hash than it does on the others

This is hard to answer. It may be that not a significant amount of effort has been invested in optimizing the Whirlpool implementations, because it's a somewhat rarely seen hash function. It may be that the huge amounts of table-lookups that Whirlpool apparently requires slow down the operations imensely compared to the register-fitting other hash functions.

• Generally random character sequences are not used, rather lists of frequently used passwords order by frequency such as at SecLists. Additionally some cracking software also fuzzes the passwords. – zaph Jan 5 '18 at 14:51