Hashcat 6.0 • Hacker News Board

Re: Hashcat 6.0

#41

Post by nine_k » Wed, Jun 17, 2020, 5:09 PM UTC

sam_goody wrote: post #11

That's ~5 commits a DAY on average since the last release a year ago, primarily from 29 contributors. That is a rate of development that bests most paid teams that I know of. I am very impressed. How do you manage so much commitment for an open source project?

A key to merging many commits (PRs, CLs, etc) is in making small commits. It's not just parceling the same amount of work into more pieces. Code review time grows very super-linearly with the amount of code to review.

Re: Hashcat 6.0

#42

Post by paulpauper » Wed, Jun 17, 2020, 5:36 PM UTC

this is why you should use scrypt vs bcrypt or some other memory intensive algo to generate hashes.

Re: Hashcat 6.0

#43

Post by penagwin » Wed, Jun 17, 2020, 5:53 PM UTC

SloopJon wrote: post #19

Hashcat has long been a user of OpenCL. I wondered whether that was because CUDA really wasn't much better for this application, but this release puts that to rest: > One of the biggest advantages of CUDA compared to OpenCL is the full use of shared memory ... This and other optimizations are the reason we improved the performance of bcrypt by 46.90%. Also interesting that they specifically call out CUDA on ARM devic…

Not a hash at dev, but my understanding is that historically, AMD has had "more raw power" GPUS then Nvidia - but has historically suffered worse driver and game implementations. This is even though the 1000x series by Nvidia, AMD cards were usually still the most used cards for crypto mining (which is basically a hash function)

As CUDA only really runs on Nvidia hardware, it makes sense that they might be motivated to be as compatible as possible.

Re: Hashcat 6.0

#44

Post by hangonhn » Wed, Jun 17, 2020, 5:53 PM UTC

Anyone know why Java's object hash is even on the list given how small it is? It's not even mean to be cryptographically secure.

Re: Hashcat 6.0

#45

Post by jonluca » Wed, Jun 17, 2020, 6:31 PM UTC

TecoAndJix wrote: post #28

j88439h84 wrote: post #8

How many hashes per second can a high end GPU do?

I ran it recently on my 1080ti: Session..........: hashcat Status...........: Exhausted Hash.Type........: MS Office 2010 Hash.Target......: $office$ 2010 100000 128 16*[removed] Time.Started.....: Sat Apr 18 09:05:24 2020 (3 mins, 35 secs) Time.Estimated...: Sat Apr 18 09:08:59 2020 (0 secs) Guess.Base.......: File (merged.txt) Guess.Queue......: 1/1 (100.00%) Speed.#1.........: 92589 H/s (2.67ms) @ Accel:256 Loops:…

Is that saying ~92k hashes per second? What's the MS Office 2010 hash type?

Re: Hashcat 6.0

#46

Post by gen3 » Wed, Jun 17, 2020, 7:16 PM UTC

umvi wrote: post #36

So what's the difference between hashcat and johntheripper? Any reason to use one over the other?

I’ve used johntheripper for wordlists and hashcat for brute-forcing, but the ethos might have changed.

Re: Hashcat 6.0

#47

Post by mmm_grayons » Wed, Jun 17, 2020, 7:39 PM UTC

hangonhn wrote: post #44

Anyone know why Java's object hash is even on the list given how small it is? It's not even mean to be cryptographically secure.

Because hashcat doesn't really reject PRs hash algorithms, at least to the extent of my knowledge, so long as the code quality is decent. Or in other words, "Why not?"

Re: Hashcat 6.0

#48

Post by mmm_grayons » Wed, Jun 17, 2020, 7:41 PM UTC

j88439h84 wrote: post #8

How many hashes per second can a high end GPU do?

That depends heavily on which hash algo: cheap GPUs can rip through MD5s but expensive ones will still take forever on bcrypt with a high work factor. Hashcat 6 beta hit 100GH/s for NTLM on a 2080 TI, though: https://twitter.com/hashcat/status/1095807014079512579?lang=...

Re: Hashcat 6.0

#49

Post by mmm_grayons » Wed, Jun 17, 2020, 7:48 PM UTC

wolf550e wrote: post #9

j88439h84 wrote: post #8

How many hashes per second can a high end GPU do?

You can find benchmarks on Google, e.g. https://gist.github.com/binary1985/c8153c8ec44595fdabbf03157... 75 giga hashes per second for ntlm.

That's v5.0.0, so not really applicable when considering the new performance improvements in version 6 or CUDA support.

Re: Hashcat 6.0

#50

Post by gcbw3 » Wed, Jun 17, 2020, 8:07 PM UTC

Cthulhu_ wrote: post #23

sam_goody wrote: post #11

That's ~5 commits a DAY on average since the last release a year ago, primarily from 29 contributors. That is a rate of development that bests most paid teams that I know of. I am very impressed. How do you manage so much commitment for an open source project?

Security researchers / developers are employed by companies and organizations that have an interest in this technology, e.g. law enforcement, secret services. I suspect most serious / active open source projects have a number of paid for developers like that. TBH, they need it, if their scale is beyond a small library / utility.

NSA also have lots grants that result in professors bullying their students to contribute to projects like these.

The reason this is MIT and not GPL makes this project all sorts of bad. MIT has its places and I have several personal open projects under it, but I can't imagine a case where society would be better by a company having closed hash cracks built on top of open source work.