0

Suppose that we have a process that generates passwords with entropy E.

I'd like to compute the average time it would take for a brute-force attack to crack an MD5-hashed instance of such a password.

From the entropy E (in bits), I can compute the total number N = 2E of candidate passwords in the universe from which a given password was chosen. On average, a brute-force attack would have to MD5-hash N/2 candidate passwords in order to crack a specific instance.

But this calculation does not give me the amount of time that this would take. For this I need some multiplier for computational performance, something of the form "x candidate passwords/second".

I imagine that computer security experts have some rule-of-thumb number to plug in for such multiplier x. If so, what is it?

(Of course, if the multiplier x does not take into account the possibility of multiple processors working in parallel, then whatever time one computes using such a multiplier would have to be divided by the number P of processors that the attacker can have running in parallel. If there's a standard rule-of-thumb-like value for P, I'd be interested in that too.)

Improve this question

1 Answer 1

Reset to default
4

The term you're looking for is "hash rate", and a quick Google search indicates that a GPU-based password cracker can try on the order of 10^10 passwords per second when cracking MD5 hashes.

Generating hashes is an example of an "embarrassingly parallel" process, so doubling the available computing resources will double your hash rate.

Improve this answer
5
  • Hash cat has a useful list to get an idea of the speed hashes can be calculated at. hashcat.net/oclhashcat/#performance
    – Hybrid
    Commented Aug 21, 2014 at 2:55
  • The question and the answer might mislead the reader because they seem to suggest that the best way to guess the MD5 hash is brute-force. But that is not the case! MD5 has been cryptanalyzed, an actual microsoft site has been spoofed because of that, and that's why all reasonable certificate authorities avoid MD5 (sha256 is the current standard).
    – Lionel
    Commented Aug 21, 2014 at 3:43
  • 4
    @Lionel, the attacks on MD5 are collision attacks, where you generate a pair of inputs with the same hash. These are totally useless for cracking passwords: for that, you need a preimage attack, where you generate an input with a pre-determined hash. The best known preimage attack on MD5 is only slightly better than brute force, and is much harder than guessing passwords.
    – Mark
    Commented Aug 21, 2014 at 3:50
  • @Mark, point taken, I'm confusing two different things. The CA attack was based on collision, and what the question is asking is preimage. That being said there exist published preimage attacks that are 2 or 3 orders of magnitude faster than brute force. This is still unmanageably complex, but arguably superior to brute force. I was mainly trying to warn casual readers about the known weakness of MD5.
    – Lionel
    Commented Aug 21, 2014 at 4:08
  • @Lionel What Mark is trying to say is that practical password cracking does not benefit from any of the published cryptographic weaknesses of MD5. The biggest downside of hashing passwords with MD5 is that it is a very fast hashing algorithm, which likewise makes cracking passwords hashed with it very quick.
    – PwdRsch
    Commented Aug 21, 2014 at 15:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .