[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120524210330.GA4250@openwall.com>
Date: Fri, 25 May 2012 01:03:30 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: Can Excessive Rounds make Password cracking Infeasable
On Thu, May 24, 2012 at 10:49:41PM +0200, magnum wrote:
> As others pointed out there are reasons the default rounds figure is not
> higher. I can imagine if just *some* or even only one hash had a much
> higher round, I would get more interested in those. OTOH this could be
> used to fool attackers (using a couple of impossible passwords with a
> very high rounds figure) to waste resources on dummy accounts.
Those dummy accounts would need to be somehow protected from attempted
logins, or they would become the weakest link for DoS'ing the server.
Such protection would likely be visible to the attackers...
> FWIW, some very quick tests on Solar's test gear with the hash above:
>
> CPU (8 cores): 4.75 c/s
> GTX580: 4300 c/s
> HD7970: 6000 c/s
>
> So while the CPU speed is hopeless, using high-end GPU's the speed is
> not that bad.
These GPU speeds are not realistic. There must be a bug or just lack of
support for non-default numbers of iterations for this hash type (this
is something for us to correct if so!)
Also, I guess you were not running Claudio's latest OpenCL code, which
should do 11.5k c/s on GTX 570 at rounds=5000.
Thanks for testing!
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
