Calculate GPU cracking time

Question

Calculating the number of password attempts to crack a password seems fairly simple (John the Ripper - Calculating brute force time to crack password) as an example. What I can't figure out is how many GPUs it will take to crack a password in a reasonable time.

As an example, how did they determine that this cluster (http://arstechnica.com/security/2012/12/25-gpu-cluster-cracks-every-standard-windows-password-in-6-hours/) creates 350 billion guess per second against NTLM, and "180 billion combinations per second against the widely used MD5 algorithm" Is it just build and measure, or simply a matter of GPU x does N calcs per second and MD5 requires x calcs per sec to decrypt a password.

I'm looking to find newer numbers than the article from 2012.

Answer 1

It's typically a 'build and measure' process to come up with cracking benchmarks. Which is not to say that someone couldn't look at a GPU processing capabilities and roughly estimate cracking speeds, but more accurate numbers come from practical implementations.

Once they have a benchmark for a GPU people might certainly estimate how that scales if they add additional GPUs, and this can be fairly accurate to an extent. At certain points in adding GPUs you have to adapt how you're managing the password cracking across them. For example, once you exhaust how many GPUs you can put in a single computer chassis you need software and/or hardware to bridge cracking to a second chassis. This too might run into scalability challenges at another point, depending on how it is being done. So just keep in mind that going from 2 GPUs to 200 GPUs isn't simply a matter of buying more cards.

The 25 GPU cluster your article mentions was created by Jeremi Gosney and Russel Graves, who continue to build commercial password cracking systems. Their most recent benchmarks for an un-overclocked 8 GPU system can be found here. They have other benchmarks with other GPUs available on their Github page too.