Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 10 Nov 2023 23:11:14 +0000
From: Jimmy Yuen Ho Wong <>
Subject: Re: 1password memorable passwords

Thanks, judging from the 16k iteration cost of the hash, even if I only try
to crack a 3 word phrase, it's still going to take at least half a century
to brute force. I think I'm going to give up now.


On Thu, Nov 9, 2023 at 10:37 PM Solar Designer <> wrote:

> On Thu, Nov 09, 2023 at 09:16:31PM +0000, Jimmy Yuen Ho Wong wrote:
> > That's what I'm doing now with a simple Rust program generating 3 word
> > combos. I'm only hitting around 1300 tries per second with
> > --format=dmg-opencl on my MBP M1 Pro 32GB, does that sound about right?
> How
> > many more tries can I get if I rent a beefier machine on the cloud?
> Like Matt correctly wrote, "if you can't remember more of your password,
> you probably are not going to be able to crack it."  The password space
> is just too large (you said 2^56) and the speed too low.
> As to the specific speeds, they depend not only on the hardware, but
> also on the iteration count used by your specific file.  It is printed
> by "john", as in a screenshot currently at the bottom of this page:
> On that page, you can also get text files with benchmark results on
> various AWS instances.  For example, for p3.2xlarge we have:
> Benchmarking: dmg-opencl, Apple DMG [PBKDF2-SHA1 3DES/AES OpenCL]...
> LWS=32 GWS=40960 (1280 blocks) DONE
> Speed for cost 1 (iteration count) of 1000, cost 2 (version) of 2 and 1
> Raw:    1743K c/s real, 5032K c/s virtual
> This is for 1000 iterations, like ancient DMG files used.  If your file
> isn't that ancient, it's probably using something like 150000 iterations,
> so the speed would be roughly 150 times lower, or around 10k per second.
> That's around 10 times faster than you have on the MBP, but still by far
> not fast enough.  At that kind of speed, you'd need a hundred thousand
> years to search the password space exhaustively, or you'd have something
> like a 0.0005% chance of cracking your password in a year.
> These are approximate numbers, but they should set the expectations.
> Alexander

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.