[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAF5WNqkQPw1_Bc66hPfwMYL2eh+sVFt915Kw7woE2j2pUuqXJQ@mail.gmail.com>
Date: Thu, 8 Apr 2021 15:39:38 -0700
From: David Sontheimer <david.sontheimer@...il.com>
To: john-users@...ts.openwall.com
Subject: Cracking stats: p/s, c/s and C/s. Hashing cost factors.
Hi - I'm using JtR to test password generation heuristics. I'm looking
for some detail into the stats printed to std_err from each fork after
a completed run, and some insight into the parameters JtR uses when
generating certain hashes for the 'test' function.
I'd like to compare apples-to-apples cracking times for heuristics
commonly seen in user-password generation (popularized by XKCD). I'm
grabbing the std_err output from each fork and generating summary
stats for a single cracking run. Time and guesses/sec are easy to
interpret. Unfortunately I'm a little confused with p/s, c/s and C/s.
I dug up:
p/s: passwords-tested/sec
c/s: crypts-computed/sec
C/s: crypts-tested/sec
(https://www.tunnelsup.com/getting-started-cracking-password-hashes)
My numbers don't match up though. Either I have my C/s and c/s mixed
up, or I'm misinterpreting 'computed' and 'tested.'
> Pwds cracked/sec: 5.821402e+10
> Crypts tested/sec: 1.489019e+09
> Crypts computed/sec: 9.232799e+10
> C/c: 62.0059186618841
> c/p: 0.025578357680475557
> p/c: 39.09555150068602
> C/p: 1.5860095658401459
Shouldn't JtR compute more hashes than it tests - not the other way
around? And what's the significance of computing and/or testing hashes
that JtR doesn't test as passwords?
---
I'm also attempting to reproduce password hashes via Python's passlib
library - with the same specs as JtR's test function. Ideally, I
should see a similar relative c/s generation between algorithms. Are
these values correct for the following parameters?
Bcrypt: 32 iterations.
Sha-256: 5000 iterations.
Sha-1: Rounds of both 64k and 40k... So c/s results in an average of
generating each?
Argon2: time/rounds = 1, memory_cost = 2, parallelism = 3... what's
the final cost (value of 4 in the example below)?
> Benchmarking: argon2 [Blake2 AVX]... (72xOMP) DONE
> Speed for cost 1 (t) of 3, cost 2 (m) of 4096, cost 3 (p) of 1, cost 4 (type [0:Argon2d 1:Argon2i]) of 0 and 1
> Raw: 3291 c/s real, 46.8 c/s virtual
Any insight would be much appreciated. Cheers.
-David
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
