John the Ripper - Calculating brute force time to crack password

Question

I'm using incremental mode (brute force) mode in John the Ripper to crack Linux MD5 passwords. I'm trying to calculate the time it will take to run through all combinations of 12 passwords (with 12 different salts for each password).

Using a 95 character count and a max length of 6 characters, there are 735,091,890,625 combinations (95^6).

Since each password is salted that puts us at (735,091,890,625 x 12) 8,821,102,687,500 hashing calculations.

When I run John the Ripper it's usually running at 1133p/s 14273c/s 14273C/s.

So...8,821,102,687,500 / 14273 = 618,027,232.36 seconds

51,502,269.36 / 60 = 10,300,453.87 minutes

858,371.16 / 60 = 171,674.23 hours

14,306.19 / 24 = 7,153.09 days

I realize there's always the possibility that a password will be cracked early. However, have I calculated that correctly? It will take 7,153.09 days (at the very maximum) to run through all combinations?

Answer 1

Your actual calculations seem solid after your edit with fixes.

However, now I'm going to handwave the math in seconds to demonstrate exponential speed increases which render fractions of days trivial. Besides, a reboot or two would mess that up regardless, not to mention actually using the machine for other things, regular patching, power outages, normal speed variance as other processes run, etc.

Your expected time depends on your assumptions. If you assume you're going to start this exact computer running on all twelve passwords and this version of JtR, and simply leave it there for a couple decades, then yes, that's about right.

If, however, we use House's corollary to Moore's law, i.e. aggregate computing power doubles every 18 months (with password hash cracking being embarrassingly parallel, this is reasonable enough to start with), then we realize that if you just wait 1.5 years, then you'd crack twice as fast, so you'd be done in about one decade instead of about two.

More advanced: You use this machine for 6 years, and are more or less 6/20ths of the way through. You then quit using your old setup, and buy a new setup that's roughly 16 times faster for a more or less reasonable price, and the remaining 14/20ths are done in 1/4th the time, i.e. 14/16=just under a year + 6 years waiting = just under 7 years.

Numbers change with money, of course.

For extra credit, have or buy a good GPU and start using GPU based tools sooner, such as oclHashcat, which should give you dramatically better speeds.