- The Musings of Chris Samuel - https://www.csamuel.org -

Applying Graphics Cards to Password Cracking

On the Beowulf list there has been a long thread [1] on GPGPU [2] and especially nVidia’s CUDA language [3]. As part of it Prentice Bisbal posted about a friend of his, Mario Juric, who decided to write a proof of concept MD5 password hashing program [4] to take advantage of CUDA.

In his message to the Beowulf list [5] Prentice quoted Mario saying:

If you attempt to compute a single hash on an entire card, you won’t get any improvement. Same as you wouldn’t if you tried it on a single vs. quad core CPU. But if you compute four hashes, than single vs. quad makes a huge difference. And the GPU cards are effectively 128 core CPUs, so when you need to compute millions of hashes…

Now Mario Juric (who organised the AstroGPU workshop [6]) has put up a web page on the program [7], which gives details of the sort of performance he got with a quick hack.

One way of visualizing this is noting that a single 8800 Ultra could brute-force break an MD5 hashed password of eight or less characters+numbers (A-Z, a-z, 0-9) in about ~16 days.

But this really is just a quick hack:

The MD5 code used here was written in less than 2 days, as a proof-of-concept, and with only a single one-liner GPU-specific optimization.

Of course if people do want to try playing with it the program is available [8], though at the moment there isn’t a software license included with it. I’ve emailed Mario about the license to see if he can clarify what the rules are.