GPU-Based Cracking: AMD Vs. Nvidia In Brute-Force Attack Performance
So, what happens when we put GPUs to work on the same task?
| Header Cell - Column 0 | Intel Core i5-2500K | Nvidia GeForce GTX 460 1 GB |
|---|---|---|
| Cores | 4 (no HT) | 336 |
| Clock Speed | 3.3 GHz (base) | 1350 MHz |
| Wireless Security Auditor | 4752 passwords/s | 18 105 passwords/s |
| Pyrit Benchmark | 3949.13 PMKs/s | 17 771.6 PMKs/s |
| Pyrit w/CoWPAtty | 3306.85 passwords/s | 19 077.15 passwords/s |
| Time To Crack Passwords Between 1 and 6 Characters (Alphanumeric) | 140 days, 14 hours (WSA) | 35 days (Pyrit) |
| Time To Crack Passwords Between 1 and 8 Characters (Alphanumeric) | 1480 years, 311 days (WSA) | 368 years, 319 days (Pyrit) |
Compared to CPUs, the performance difference is incredible. A single GeForce GTX 460 manages roughly 4x the performance of a Core i5-2500K.
That Forensic Computers, Inc. Tableau TACC1441 mentioned earlier should have been an indication that GP-GPU computation would outperform desktop CPUs. After all, the FPGA-based accelerator consists of a massively parallel array of processors that operate in concert to attack multiple types of encryption schemes. This is a problem better-addressed by many cores operating concurrently.
Now, we know how a mid-range graphics card fares against a fairly mid-range CPU. What happens when we start ratcheting up the complexity of our graphics configuration?
It's striking to see how much faster AMD's cards are than Nvidia's. The Radeon HD 6990 sports a greater number of ALUs than the GeForce GTX 590, though. Moreover, it has been shown that there are certain operations AMD's ALUs are able to execute more efficiently.
For some reason, we did have to enable CrossFire to get the second Radeon HD 6990 to appear under WSA (generally, multi-GPU configurations don't need to be running in CrossFire or SLI to operate cooperatively). Both technologies can slow down a brute-force attack because they're designed to help balance GPU workloads. In this case, CrossFire actually works to the detriment of performance. With AMD's multi-card feature disabled, we achieve the expected linear performance scaling in Linux.
Brute-force password cracking in a reasonable amount of time is wholly dependent on the number of cores you wield and the speed at which they operate.
| Time To Find Crack... | Passwords Between 1 and 6 Characters (Alphanumeric) | Passwords Between 1 and 8 Characters (Alphanumeric) |
|---|---|---|
| Nvidia GeForce GTX 460 1 GB | 35 days (Pyrit w/ CoWPAtty) | 368.9 years (Pyrit w/ CoWPAtty) |
| Nvidia GeForce GTX 590 | 11.6 days (Pyrit w/ CoWPAtty) | 122.5 years (Pyrit w/ CoWPAtty) |
| 2 x Nvidia GeForce GTX 590 | 6.5 days (WSA) | 68.66 years (WSA) |
| AMD Radeon HD 6850 | 20.4 days (WSA) | 214.75 years (WSA) |
| AMD Radeon HD 6990 | 5.88 days (WSA) | 62.24 years (WSA) |
| 2 x AMD Radeon HD 6990 | 3.08 days (Pyrit w/ CoWPAtty) | 32.97 years (Pyrit w/ CoWPAtty) |
Though not common, a pair of GeForce GTX 590s or Radeon HD 6990s in a high-end gaming rig isn't unheard of. Clearly, passwords consisting of seven characters or more are fairly safe. But bear in mind also that we're also looking at worst-case scenarios. The numbers cited above are indicative of searching for a password between 00 and 99, and the right answer ends up being 99. The correct answer is just as likely to be 00, slashing the compute time.