I came across this very alarming sounding thread which indicates a GPU with about half the compute capacity of the GPU currently powering the monitor I type this on is capable of
I'm not sure what a
c is in this jargon. Does it stand for "crack"?
Does this mean 11.5 thousand passwords tested per second? So if my password uses 5000 round SHA-512, and is a weak enough password that comes in at #11,500 in the attacker's dictionary, I'm pwned in as little as 1.0 second?
the quote is
11.5k c/s at rounds=5000 which is the default number of rounds. I guess it's not too terribly alarming if the password is lengthy and "random" enough as it really should require extraordinary luck to hit upon it in the first several million attempts; however with a small GPU farm you can crunch through several million within a short time. It's bound to get cracked eventually.
c/s cannot stand for rounds/sec as indicated here; my 500,000 round SHA-512
$6$rounds=500000$... password gets verified by the machine within about 1 second; that amounts to 500K rounds/sec roughly.
To do a little scribbling on
the back of an envelope
11,500 * 5000 = 57,500,000 rounds/s
This is an over 100 fold increase compared to my estimated CPU verification speed in rounds/s. I might be able to believe that my GPU can pull that off. It sure can do so with pixels.
Or does it mean on average, 11,500 user accounts can be cracked per second? Now that would be truly impressive.
I'm gonna go update my password now. The root password that I intend on distributing to my VM's through a kickstart script which necessarily happens over HTTP.