Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 25 May 2012 01:03:30 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: Can Excessive Rounds make Password cracking Infeasable

On Thu, May 24, 2012 at 10:49:41PM +0200, magnum wrote:
> As others pointed out there are reasons the default rounds figure is not
> higher. I can imagine if just *some* or even only one hash had a much
> higher round, I would get more interested in those. OTOH this could be
> used to fool attackers (using a couple of impossible passwords with a
> very high rounds figure) to waste resources on dummy accounts.

Those dummy accounts would need to be somehow protected from attempted
logins, or they would become the weakest link for DoS'ing the server.
Such protection would likely be visible to the attackers...

> FWIW, some very quick tests on Solar's test gear with the hash above:
> 
> CPU (8 cores): 4.75 c/s
> GTX580: 4300 c/s
> HD7970: 6000 c/s
> 
> So while the CPU speed is hopeless, using high-end GPU's the speed is
> not that bad.

These GPU speeds are not realistic.  There must be a bug or just lack of
support for non-default numbers of iterations for this hash type (this
is something for us to correct if so!)

Also, I guess you were not running Claudio's latest OpenCL code, which
should do 11.5k c/s on GTX 570 at rounds=5000.

Thanks for testing!

Alexander

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.