On the: http://www.netmux.com/blog/how-to-build-a-password-cracking-rig

We can see the following examples, they used 4 GPUs:

Hashtype: SHA1 Speed.Dev.#*.....: 25963.3 MH/s

And according to: https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html

it took Google 110 GPUs (?) and 1 year to find a SHA-1 collision:

Nine quintillion (9223372036854775808) SHA1 computations in total

to create a SHA1 collision.

1 year = 31540000 seconds.

pw rig url SHA1: 25963.3 MH/s = 25963300000 H/s / 4 = 6490825000 H/s/GPU

so according to the pw rig website, 110 GPU could do sha1: 31540000*6490825000*110 = 22519268255000000000

and Google did: 9223372036854775808

so the GPU that was used in the pw rig is 2.4x times faster regarding SHA-1 that the GPU used by Google?

The Question:: are the calculations correct?

closed as off-topic by Tobi Nary, techraf, Steffen Ullrich, CaffeineAddiction, Arminius Feb 25 '17 at 12:03

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Tobi Nary, techraf, Steffen Ullrich, CaffeineAddiction, Arminius
If this question can be reworded to fit the rules in the help center, please edit the question.


The speed of basic GPU hashing like used in password cracking rig and the speed of GPU shattered hashing like used in Google's rig are not directly comparable.

For once, the Shattered attack don't just use regular SHA-1 algorithm, but deconstructs the SHA-1 algorithm in a way that makes it more likely to find a collision with less computations than a pure brute force. Such deconstructed SHA-1 algorithm may be slower than a straight up SHA-1, but is beneficial since it reduces the number of SHA-1 computation you need to do. Second, the speed of computing SHA-1 depends on the size of the data.

Another factor is that Cloud providers like Google likes to use standardized GPU when talking about performance. In case of Google Compute Engine, they seem to use Nvidia Tesla K80 as the standard GPU. Assuming that Google SHA-1 attack used the same GPU as used in Compute Engine GPU, then according to this WPA hash benchmark:

Tesla K80     150000      hash/s
GeForce GTX 1080  395000      hash/s

Note that this benchmark is against WPA rather than SHA-1. The speed ratio between the two GPUs (395000/150000=2.6) seems to roughly correspond with your calculation, but this is likely a coincidence.

Not the answer you're looking for? Browse other questions tagged or ask your own question.