Unlocking from A to Z

Our blog features numerous articles on how to crack passwords and access encrypted data, from simple how-to guides to comprehensive manuals. However, many of the questions we are frequently asked are not about technical aspects but rather about the basics of password recovery. Can you crack that password? Is it legal? How long do you think it will take to break this one? We have the answers, but they require delving into the extensive content of our blog. To address this, we have created a comprehensive A to Z article that not only answers many common questions, but also includes links to our previous posts.

Why do we attack passwords (and not encryption)?
We attack passwords rather than encryption because modern encryption methods are extremely secure and virtually unbreakable due to their complexity and long key lengths. The industry-standard AES-256 algorithm used in virtually all encrypted formats employs 256-bit keys, creating an astronomical number of possible combinations that would take an unfeasible amount of time to decrypt by brute force. Passwords, on the other hand, are the entry point to this encryption and are often much weaker due to human limitations in remembering complex strings. Therefore, it is more practical and efficient to target the password itself rather than trying to break the encryption algorithm.

What is “strong encryption”?
Strong encryption is a type of encryption that cannot be decrypted in a reasonable period of time by directly attacking the encryption key. A strong encryption method should not have vulnerabilities that allow an attacker to significantly reduce the time needed to decrypt it. To decrypt data protected by strong encryption, you must know the password or possess the original encryption key. The AES encryption algorithm with 256-bit keys is considered secure as no vulnerabilities have been discovered over many years of use. Therefore, if strong encryption is used, attacking the password is the only viable way to access the encrypted data.

Will quantum computing change that?
Quantum computing has the potential to change the landscape of encryption cracking. While classical encryption methods are incredibly secure against attacks with traditional computing methods, quantum computers can process information in fundamentally different ways. Grover's algorithm, which could be used by quantum computers, would reduce the effective key length of AES-256 to 128 bits, greatly reducing the time needed to crack the encryption key, but even 128-bit keys are virtually unbreakable. However, AES-256 is still considered secure against quantum attacks because it would require a quantum computer with capabilities far beyond what is currently feasible. So, while quantum computing poses future challenges (or opportunities, depending on which side you're on), it still doesn't fundamentally change the approach to attacking passwords as an entry point to encryption.

Is it legal to crack passwords?
The short answer is “it depends.” Regulatory jurisdictions have different rules; In some countries, suspects must reveal their passwords when questioned by authorities (welcome to France, the country of Liberté). Obviously, no one can stop you from deciphering your own lost or forgotten password; However, if this password protects access to your data stored on some online service, it doesn't really matter that the account is yours since you can't legally attack it. In other words, cracking passwords is perfectly legal if you work with local data and the data is yours, or if you have permission from the legal owner, or if you work for legal authorities and follow local regulations. Decrypting another person's data may be a criminal offense, but there is a huge gray area.

Is a million passwords per second a lot?
We have a tool that leverages the computational power of modern GPUs along with modern multi-core processors to maximize the speed of password attacks. The benchmarks demonstrate recovery speed on various hardware configurations for different encryption formats. These speeds vary widely; For some formats, even the best hardware can only try a few passwords per second, while for others, speeds can reach millions of passwords per second.

So, is a million passwords per second a lot or a little?

The thing is, this is not the right question. The correct question would be “What types of passwords can be cracked in a given period of time at a speed of one million passwords per second?” or “How long will it take to crack a given password at a rate of one million passwords per second?” To answer them, we publish some formulas that will allow us to calculate the answer.

In the first scenario, there is a typical situation where neither the length nor the complexity of the password is known in advance, but there is a certain time limit on how much time we can spend on the attack. In the second scenario, the limit is on the maximum length and complexity of the password (for example, we only try passwords containing digits and Latin letters in both cases plus a small set of special characters), while we calculate the time needed to try all possible ones. combinations.

For example, if a given password can be hacked at the speed of 10 million passwords per second, it would take no more than five minutes to recover a password consisting of only 5 Latin letters in both cases. If the rate is 100 passwords per second and the password is at least 7 characters long and has symbols from the extended character range, the maximum attack time increases to about 700 billion seconds, or about 22,000 years. You can find formulas to calculate attack times and much more useful information in our guide.

How to compare password recovery speeds?
Benchmarking password recovery is a little more complex than the pretty graphs may suggest. We always test using a full brute force attack method with a fixed password length and a specific character set limitation. Additionally, testing is always performed by running a brute force attack. The brute force attack allows us to measure the pure attack speed on a particular GPU or CPU model. Other attack methods, such as mask attacks, dictionary attacks, or more complex hybrid attacks, require additional calculations that can limit graphics card utilization. Finally, we did not start measurements immediately. Instead, we wait several minutes for the attack to “resolve,” giving the tool some time to load and compile the required code on the GPU.

Why do we need video cards? What about distributed attacks?
Most password protection methods rely on multiple rounds of hash iterations to curb brute force attacks. Even the fastest processors choke when trying to crack a reasonably strong password. Video cards can be used to speed up recovery with GPU acceleration, however, the GPU market is currently overheated and most high-end video cards are highly overpriced. Today we will test a bunch of low-end video cards and compare their price/performance ratio.

Using GPU cores instead of CPU helps crack passwords faster. Even the slowest integrated GPU with a TDP of several watts can effortlessly demonstrate performance comparable to a 190W CPU. High-end GPUs such as the NVIDIA RTX 4080 can crack passwords up to 500 times faster compared to a regular Intel Core i7 CPU, while mid-range video cards offer up to a 250x increase.

GPU acceleration offloads intensive computational calculations from the computer's CPU to the Compute Units (CUs) of the video card. A dedicated video card can deliver speeds that far exceed the metrics of a high-end CPU. Even a modest integrated GPU (one built into a CPU) can match or exceed the performance of the central processor while consuming significantly less electricity and dissipating a fraction of the heat produced by the CPU under a similar load.

Often, even several high-performance graphics cards may not be enough to successfully recover a password in a reasonable period of time. In such cases, distributed computing (see Elcomsoft Distributed Password Recovery) comes to the rescue. The effectiveness of distributed computing versus using GPUs largely depends on the data format and hashing algorithm. If data can be accelerated on a GPU, even basic graphics cards can outperform a large network of non-accelerated computers. However, multiple computers, each equipped with several powerful GPUs, can provide a significant advantage over a single computer. In particular, some algorithms cannot be accelerated at all on GPUs, making distributed computing the only option to accelerate the attack.

Therefore, while a distributed network is generally better, each computer on the network should be equipped with powerful GPUs for optimal performance.

Will video cards eventually replace CPUs?
This is very unlikely. GPUs will not replace CPUs due to their fundamental architectural differences. GPUs excel at parallelizing a single operation across thousands of threads, making them very efficient for tasks like cracking passwords. However, for everyday tasks, CPUs are better suited because their cores can operate completely independently. This independence allows CPUs to handle a variety of tasks simultaneously, while each GPU core is slower than an individual CPU core and can only perform the same operation at the same time. Therefore, while GPUs are faster for specific parallelizable tasks, CPUs are necessary for the diverse and independent tasks found in everyday computing.

Which video card is best for cracking passwords?
If you are looking for a new system, buy the most powerful current generation NVIDIA board that fits your budget. If you already have previous generation GPUs, you can continue using them if they are powerful enough; if not, see above. Keep in mind that previous generation GPUs are generally not worth it if you buy new, even if the price seems attractive.

What about FPGA/ASIC?
They are great in theory, not so much in real life due to their high cost and limited software support. Of course, you could build a cost-effective ASIC, but its price only goes down enough with an economy of scale. There is simply not enough demand from a password cracking perspective to build a cost-effective ASIC, and let's not forget the still limited software support. If you're looking for efficient acceleration hardware, look for low-power GPUs.

How to build an efficient password cracking computer
Power consumption and energy efficiency are two crucial parameters that are often overlooked in favor of pure speed. When building a workstation with a 24/7 workload, absolute performance numbers become arguably less important compared to performance per watt.

Building a data center: calculating energy consumption
When building a data center with multiple power-hungry GPU-equipped computers, it is critical to calculate the total power consumption of the system as a whole to ensure accurate planning of power supply and heat dissipation.

For example, consider a configuration with one hundred GPUs, each with a maximum consumption of 300 W, installed on multiple workstations. In addition to these, there would be the necessary number of UPS. Altogether, this configuration would require at least 45 KW of power. You will not only need an adequate power supply, but also enough air conditioning to cool the room.

How does encryption work? What is the difference between passwords and encryption keys?
Passwords are used to protect access to documents, databases, compressed files, encrypted disks, and many other things you can imagine. When it comes to encryption, passwords are almost never stored, whether they are encrypted or not. Instead, passwords are “hashed” or transformed with a one-way function. The result of the transformation, if performed correctly, cannot be reversed and the original password cannot be “cracked” from the result of a hash function.

Raw password hashes are rarely used directly as encryption keys. For example, many disk encryption tools can use passwords to encrypt a so-called “protector,” which in turn is used to protect the “key encryption key,” which in turn is used to protect the “media encryption key,” which in turn is ultimately used to encrypt and decrypt data. In particular, there are types of protectors that do not use passwords at all (instead, they may employ TPMs, recovery keys, or USB flash drives to unlock the drive). The password is the only thing that can be broken by trying several different combinations.

Typically, a password is hashed using multiple rounds of a one-way transformation function and then stored in the file header, allowing the password to be verified without actually decrypting the encrypted content. The encryption key itself is different from the saved hash, but password attacks are performed against this hash. If the correct password is found, the encryption key is calculated separately. Sometimes the password hash is not stored in the file header, requiring decryption of some or all of the data to verify the password, slowing down the attack. The speed of such an attack depends on the size of the data that needs to be decrypted. A common format that uses this approach is RAR4 archives. The later version, RAR5, no longer uses this approach.

What types of attacks are available?
There are several methods to recover the original password, from brute force to very complex rule-based attacks.

In theory, all possible password combinations up to a certain length would be tried during a brute force attack, but in practice this is usually limited to a subset of characters (such as upper and lower case Latin letters, digits, and some special characters). Since the entire Unicode set is 149,186 characters, running a brute force attack on the entire character set is simply infeasible. Even a three-character password made up of the full set of Unicode would take an impractically long time to crack. In reality, passwords rarely include symbols from such diverse and widespread character sets, so brute force attacks are often limited to certain alphabets.

Brute force attacks are the fastest, but due to the greater number of passwords one must try during these attacks, brute force is the last resort when all other options are exhausted. Since brute force is extremely inefficient for longer passwords, other types of attacks were invented to reduce the number of passwords to be tested. Dictionary attacks use words from the English language dictionary (and/or the user's native language) as possible passwords. Other attacks using masks, mutations, and custom rules are also available.

The order matters
With the many types of password recovery attacks, when would you use each of them and in what order? The following article explains how to request password recovery jobs based on the data types and available owner information.

GPU and CPU utilization

When it comes to encryption, data formats differ in various ways. One of the major differences is the type of hardware that can be used for running and accelerating password recovery attacks. There are three main scenarios:

1. Brute force supports GPU acceleration, with minimal CPU usage.
2. Brute force only works on CPUs, making GPUs irrelevant. GPU acceleration not supported.
3. Both GPUs and CPUs are utilized, with GPUs doing the bulk of the work and CPUs providing additional support (sometimes using multiple cores).

GPU-accelerated attacks

GPUs excel at performing multiple simple calculations in parallel across many cores. This makes them ideal for brute force attacks on formats that can be split into a large number of simple tasks. When a job can be split to run across thousands of GPU cores, the few cores of the computer's CPU become insignificant, as they add minimal performance gains while increasing overhead.

CPU-only attacks (GPU-resistant algorithms)
Some algorithms are designed to resist GPU-accelerated attacks. This can be achieved by various means. On the one hand, GPU cores handle simple tasks well, but fail with more complex calculations required by some password-to-binary key transformations. These algorithms must run on CPU, which significantly slows down the attack speed.

GPU-assisted attacks with high CPU utilization
Some algorithms use GPU and CPU cores. Typically, the GPU handles most of the workload, while the CPU performs essential supporting tasks. For example, a powerful 16-core CPU may help the GPU, but it won't match the brute force speed the GPU can achieve on its own.

Non-brute force attacks, which are typically more efficient, still place heavy loads on the CPU. These “smart” attacks are slower than brute force because they rely on batches of passwords that must be generated. In certain formats, the CPU may have difficulty generating batches of passwords fast enough to fully load the GPU, requiring the generation to run on the GPU itself, further overloading the GPU and slowing down the attack.

Algorithms that require a lot of memory
Some hashing algorithms are designed to thwart GPU attacks by requiring significant memory usage. For example, the Scrypt algorithm, used in BestCrypt, ensures that even the weakest computers can verify a single password without problems, but trying to run many checks in parallel on a GPU would quickly exhaust its memory. This deliberate design choice makes such algorithms GPU resistant.

By Oleg Afonin forelcomsoft.com