Date: Fri, 10 Nov 2023 23:11:14 +0000 From: Jimmy Yuen Ho Wong <wyuenho@...il.com> To: john-users@...ts.openwall.com Subject: Re: 1password memorable passwords Thanks, judging from the 16k iteration cost of the hash, even if I only try to crack a 3 word phrase, it's still going to take at least half a century to brute force. I think I'm going to give up now. Jimmy On Thu, Nov 9, 2023 at 10:37 PM Solar Designer <solar@...nwall.com> wrote: > On Thu, Nov 09, 2023 at 09:16:31PM +0000, Jimmy Yuen Ho Wong wrote: > > That's what I'm doing now with a simple Rust program generating 3 word > > combos. I'm only hitting around 1300 tries per second with > > --format=dmg-opencl on my MBP M1 Pro 32GB, does that sound about right? > How > > many more tries can I get if I rent a beefier machine on the cloud? > > Like Matt correctly wrote, "if you can't remember more of your password, > you probably are not going to be able to crack it." The password space > is just too large (you said 2^56) and the speed too low. > > As to the specific speeds, they depend not only on the hardware, but > also on the iteration count used by your specific file. It is printed > by "john", as in a screenshot currently at the bottom of this page: > > https://www.openwall.com/john/cloud/ > > On that page, you can also get text files with benchmark results on > various AWS instances. For example, for p3.2xlarge we have: > > Benchmarking: dmg-opencl, Apple DMG [PBKDF2-SHA1 3DES/AES OpenCL]... > LWS=32 GWS=40960 (1280 blocks) DONE > Speed for cost 1 (iteration count) of 1000, cost 2 (version) of 2 and 1 > Raw: 1743K c/s real, 5032K c/s virtual > > This is for 1000 iterations, like ancient DMG files used. If your file > isn't that ancient, it's probably using something like 150000 iterations, > so the speed would be roughly 150 times lower, or around 10k per second. > That's around 10 times faster than you have on the MBP, but still by far > not fast enough. At that kind of speed, you'd need a hundred thousand > years to search the password space exhaustively, or you'd have something > like a 0.0005% chance of cracking your password in a year. > > These are approximate numbers, but they should set the expectations. > > Alexander >
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.