
Date: Thu, 8 Apr 2021 15:39:38 0700 From: David Sontheimer <david.sontheimer@...il.com> To: johnusers@...ts.openwall.com Subject: Cracking stats: p/s, c/s and C/s. Hashing cost factors. Hi  I'm using JtR to test password generation heuristics. I'm looking for some detail into the stats printed to std_err from each fork after a completed run, and some insight into the parameters JtR uses when generating certain hashes for the 'test' function. I'd like to compare applestoapples cracking times for heuristics commonly seen in userpassword generation (popularized by XKCD). I'm grabbing the std_err output from each fork and generating summary stats for a single cracking run. Time and guesses/sec are easy to interpret. Unfortunately I'm a little confused with p/s, c/s and C/s. I dug up: p/s: passwordstested/sec c/s: cryptscomputed/sec C/s: cryptstested/sec (https://www.tunnelsup.com/gettingstartedcrackingpasswordhashes) My numbers don't match up though. Either I have my C/s and c/s mixed up, or I'm misinterpreting 'computed' and 'tested.' > Pwds cracked/sec: 5.821402e+10 > Crypts tested/sec: 1.489019e+09 > Crypts computed/sec: 9.232799e+10 > C/c: 62.0059186618841 > c/p: 0.025578357680475557 > p/c: 39.09555150068602 > C/p: 1.5860095658401459 Shouldn't JtR compute more hashes than it tests  not the other way around? And what's the significance of computing and/or testing hashes that JtR doesn't test as passwords?  I'm also attempting to reproduce password hashes via Python's passlib library  with the same specs as JtR's test function. Ideally, I should see a similar relative c/s generation between algorithms. Are these values correct for the following parameters? Bcrypt: 32 iterations. Sha256: 5000 iterations. Sha1: Rounds of both 64k and 40k... So c/s results in an average of generating each? Argon2: time/rounds = 1, memory_cost = 2, parallelism = 3... what's the final cost (value of 4 in the example below)? > Benchmarking: argon2 [Blake2 AVX]... (72xOMP) DONE > Speed for cost 1 (t) of 3, cost 2 (m) of 4096, cost 3 (p) of 1, cost 4 (type [0:Argon2d 1:Argon2i]) of 0 and 1 > Raw: 3291 c/s real, 46.8 c/s virtual Any insight would be much appreciated. Cheers. David
Powered by blists  more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.