Date: Fri, 25 May 2012 01:03:30 +0400 From: Solar Designer <solar@...nwall.com> To: john-users@...ts.openwall.com Subject: Re: Can Excessive Rounds make Password cracking Infeasable On Thu, May 24, 2012 at 10:49:41PM +0200, magnum wrote: > As others pointed out there are reasons the default rounds figure is not > higher. I can imagine if just *some* or even only one hash had a much > higher round, I would get more interested in those. OTOH this could be > used to fool attackers (using a couple of impossible passwords with a > very high rounds figure) to waste resources on dummy accounts. Those dummy accounts would need to be somehow protected from attempted logins, or they would become the weakest link for DoS'ing the server. Such protection would likely be visible to the attackers... > FWIW, some very quick tests on Solar's test gear with the hash above: > > CPU (8 cores): 4.75 c/s > GTX580: 4300 c/s > HD7970: 6000 c/s > > So while the CPU speed is hopeless, using high-end GPU's the speed is > not that bad. These GPU speeds are not realistic. There must be a bug or just lack of support for non-default numbers of iterations for this hash type (this is something for us to correct if so!) Also, I guess you were not running Claudio's latest OpenCL code, which should do 11.5k c/s on GTX 570 at rounds=5000. Thanks for testing! Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.