Harden Up: Can We Break Your Password With Our GPUs?

Name: Test Setup - Harden Up: Can We Break Your Password With Our GPUs?
Author: Andrew Ku

by Andrew Ku June 19, 2011 at 11:00 PM

Test Setup

Test Hardware
Processor	Intel Core i5-2500K (Sandy Bridge), 3.3 GHz, LGA 1155, 6 MB Shared L3
Motherboard	Asus P8P67 Deluxe
Memory	Kingston Hyper-X 8 GB (2 x 4 GB) DDR3-1333 @ DDR3-1333, 1.5 V
Hard Drive	Samsung 470 256 GB
Graphics	Palit GeForce GTX 460 1 GB Asus GeForce GTX 570 1.28 GB AMD Radeon HD 5870 1 GB
Power Supply	Seasonic 760 W, 80 PLUS
System Software and Drivers
Operating System	Windows 7 Ultimate 64-bit
DirectX	DirectX 11
Driver	Nvidia 270.51 Catalyst 11.4

Software
Visual Zip Password Recovery Processor	Version: 6.2
Advanced Archive Password Recovery	Version: 4.53
Accent Zip Password Recovery	Version: 2.01
Accent RAR Password Recovery	Version: 2.01
Parallel Password Recovery	Version: 1.6.0
WinZip	Version: 15.5 Pro Encryption: Zip 2.0 (default), AES-128, AES-256 Compression: No Compression, Zipx/PPMd (default), Zip/deflate
WinRAR	Version: x64 4.00 Encryption: AES-128 Compression: Normal, Store

It's important to point out that WinZip offers three different encryption options: Zip 2.0, AES-128, and AES-256, along with several compression schemes. WinRAR is much simpler in that it only offers AES-128 encryption and different levels of the same compression scheme. I'm testing with several variations to show you how this affects the speed of password recovery.

Previous Next

Summary

About the author

Andrew Ku

This thread is closed for comments

92 comments

Comment from the forums

Your comment

jeff77789

"While it would take a longer time to find a password made up of nine or 10 passwords, it's definitely doable between a few gaming buddies. "

9 or 10 characters?
jj463rd

How about adding some extended ASCII codes to a password.
ryandsouza

"Think of this as generating every single combination of numbers that can be used to solve that same Sodoku puzzle, starting from an all zeros all the way through all nines. "

Sudoku puzzles have numbers from 1 through 9!
rpmrush

This reminds me of Bitcoin GPU crunching. 6990s are favored right now. I wonder how many were sold specifically to Bitcoin miners? I tried it with my dual 6850s but the heat was rediculous. I didn't like the stress on my hardware so I gave up mining. I'm sure it's the same with password software. Maxing out your GPUs. Great for Winter, not Summer!
mediv42

I've always wondered about this: why don't they just code a delay into the decryption program, so you can't check a billion passwords a second?
joshyboy82

I like the scale, but in your small example (a,b,c) you were right and wrong at the same time. Based on your configuration 6 possibilities are correct, but because you tell someone that they can use A or B or C in the password doesn't stop them from choosing aaa, therefor the combination is 9, not 6. Otherwise, interesting article.
acku

276101 said:

"Think of this as generating every single combination of numbers that can be used to solve that same Sodoku puzzle, starting from an all zeros all the way through all nines. " Sudoku puzzles have numbers from 1 through 9!

Fixed! Sorry. I usually play Sudoku variants.

424793 said:

I like the scale, but in your small example (a,b,c) you were right and wrong at the same time. Based on your configuration 6 possibilities are correct, but because you tell someone that they can use A or B or C in the password doesn't stop them from choosing aaa, therefor the combination is 9, not 6. Otherwise, interesting article.

I could understand that, but I left out that since I was trying to show a simple example of how permutations differ from combinations. As you pointed out, repetitions are allowed in passwords. I actually mention that in the sentence that follows in the next paragraph.
webdev511

Password Haystacks Yes Steve Gibson has already covered something like this. Passphrases with upper lower number and speical are the way to go. Yes, please avoid shortcuts.
acku

179702 said:

I've always wondered about this: why don't they just code a delay into the decryption program, so you can't check a billion passwords a second?

It wouldn't be easy from a design standpoint, cause now you're talking about fiddling with the design of the program.

The easiest way to slow down the verification portion of the password authentication process is increasing the number of transformation invocations for key generation. The problem is that this slows down the performance of your machine, even if you have the correct password.

jj463rdHow about adding some extended ASCII codes to a password.

That assumes WinZip and WinRAR supports them. To be honest, I haven't looked into that. Though, I'm inclined to believe that neither program supports them.
shin0bi272

the tables in this review are horrible... they go from lengths of time to number of passwords and theres no discernible notation when they do.
Mark Heath

Cracking a password? There's an app for that.

Saw something on this elsewhere recently (http://www.zdnet.com/blog/hardware/cheap-gpus-are-rendering-strong-passwords-useless/13125)

I've changed the password for important (tangible value) passwords such as that for my steam account to a password that now uses a few special characters, and some mixed up numbers, lower and upper case letters, totalling 18 characters. (lol)

Now I have a few different tiers of passwords, a now replaced 8 string of letters and numbers for unimportant things a couple of years ago, a now replaced string of 15 characters for semi-important things a couple years ago (have real world information or usefulness for a potential bad guy), their 8 and 15 respectively replacements and my new 18 character string for things that have definite tangible real world value to potential nasties.

And being only 15 I think I'm on the right track

The only thing that *really* worries me are the choice of security questions sometimes. If you're not allowed to pick your own, the answer would be easy to find on my Facebook page or similar (if I had one ) Mother's maiden name? There's a Facebook page for that.
acku

Mark HeathCracking a password? There's an app for that.Saw something on this elsewhere recently (http://www.zdnet.com/blog/hardware/cheap-gpus-are-rendering-strong-passwords-useless/13125)I've changed the password for important (tangible value) passwords such as that for my steam account to a password that now uses a few special characters, and some mixed up numbers, lower and upper case letters, totalling 18 characters. (lol)Now I have a few different tiers of passwords, a now replaced 8 string of letters and numbers for unimportant things a couple of years ago, a now replaced string of 15 characters for semi-important things a couple years ago (have real world information or usefulness for a potential bad guy), their 8 and 15 respectively replacements and my new 18 character string for things that have definite tangible real world value to potential nasties.And being only 15 I think I'm on the right track The only thing that *really* worries me are the choice of security questions sometimes. If you're not allowed to pick your own, the answer would be easy to find on my Facebook page or similar (if I had one ) Mother's maiden name? There's a Facebook page for that.

Actually, AccentZIP and AccentRAR are real world derivatives of the ighashgpu program that Zdnet wrote about. Ivan Golubev actually wrote the code for all three programs and we had the pleasure of working with him to write this article. The difference is that with ighashgpu, you're mainly looking at hash cracking.
aaron88_7

You could buy multiple GPU's for a hefty price, or you could just use Amazon's cloud computing to do it for you....

http://www.securityweek.com/commercial-software-harnesses-amazon-cloud-crack-passwords-faster
aaron88_7

Oops, link didn't show up, here it is:

Linky Linky
acku

413287 said:

Oops, link didn't show up, here it is: Linky Linky

Interesting. According to the article, it seems that the password recovery speed is limited by the internet connection.

I seem to recall seeing someone mention that a pair of 590s was faster than 30000 passwords per second with Elcomsoft's GPGPU document cracker.

Heck, assuming only 2002 SHA-1 transformations, a single GTX 460 would be faster.
compton

How much of a jem is this article? This is way better than trying to save 3 cents a year on your power bill. I for one would like to see the process expanded into a benchmark if possible. For one thing, it could be an excellent for CPUs where it seems like it's more optimized -- GPUs are basically limited to nVidia's CUDA, but I still think the brain trust at Toms could find a way to make an informative benchmark out password cracking.
kkiddu

What if you have TRANSLTR?
Hupiscratch

A next good article would be a search for the best decryption software. Let the decryption roundup begins!
Interesting article. I personally use a fairly simple way to use one different password for each website / service following an easy to remember pattern. The method is described here:

http://passwordadvisor.com/TipsUsers.aspx

Would also be interesting to see if Sandy Bridge AES instructions helps on brute force.
srgess

Im surprise they haven't tested Elcom solution, they are faster for recovery password with any competition with some process. You can put make a network resource. So lets say you have a lots of money and put 10-20 4 SLI GTX 590 computer or Tesla computer available resource to get a super computer , password cracking will pass from days to second. Imagine Top supercomputer in the world and its just a beginning. Soon we gonna have to have password with 20 + alpha numeric and special character. Or data crash after 10 attempt.
tomfreak

The credit card pin number for online transaction are still 3 numeric digit & it cannot be change LOL, then the ATM machine are still 6 numeric digit, thats how simple our banking system these days. Even my Wifi key is already 63 characters consist of upper/lower case alphabet, numeric and symbols.
orwells

Why has Amazon EC2 been ignored?

Why are there so many tables for ZIP 2.0 and almost none for AES? It was said zip was unsafe at the beginning, a table or two should be enough. Yet, I learned very little of AES, the standard nowadays.
TheViper

Kkiddu, I was hoping someone would bring that up. 3 million parallel processors cracking at it at once. Full ASCII 64 bit keys in ~ 4 minutes. So long as the cooling holds up.
Never mind chinas 7,168 NVIDIA Tesla GPU super computer....