Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sun, 22 Nov 2020 17:38:21 +0900
From: SQP Admin <>
To:, Solar Designer <>,
Subject: Re: Session management on AMI - Interrupting and

Hi Alexander, Magnum,
Thank you for the prompt and insightful feedback.
> The way incremental mode works, limiting the character set to Alnum (62
> different characters) provides only a slight reduction in cracking time
> (if the password fits this character set) than the default (letting JtR
> use all 95 printable characters, but aware that most of those are rather
> uncommon and are only commonly seen in certain combinations).  So you
> need to be very confident the password fits this character set in order
> to reasonably limit the attack like that.
We were actually assuming that our password would not have special 
characters and thus that proceeding with an Alnum incremental attack at 
first would be much faster and potentially save us money, should our 
assumption be true. We understand now that the time benefit is only 
minimal, thank you very much for these insights.
> 2. Use one of the tools "screen" or "tmux", both of which are readily
> available in the AMI.  You'd use them before you start the original
> session, or before you restore it, so that you wouldn't have to do the
> interrupt and restore thing again, but would simply re-attach to the
> running session.
We have followed your advice and are using screen. It is pretty 
straightforward. Thank you for the recommendation.
> Most importantly, are you running this instance as spot?  You really
> should be, and maybe c5.24xlarge will fit your budget then, without
> having to interrupt it?
We switched to a spot c5.18xlarge instance following your advice, the 
costs are much lower which will allow us to run our attack for a longer 
time and stay within the budget. Thanks a ton for the recommendation.
> Actually, for WinZip you'd have better speed and performance/dollar on a
> GPU in p3.2xlarge.  So I assume/hope you have a PKZIP archive, for which
> "--fork=96" on c5.24xlarge is appropriate.
The file we are working on is a PKZIP archive. Therefore we are taking 
the CPU approach as we saw recommended while browsing the documentation. 
We are running a regular incremental attack, "--fork=72" on a 
c5.18xlarge, thanks to your previous advice. The passwords tried per 
second difference with a c5.24xlarge seems minimum, so we went with the 
less expensive of the two.

Thank you again for you support.


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.