(Tested) Cracking MD5 Passwords with a GeForce Graphics Card

Further to this news, I took a little time to test the Lightning Hash Cracker software. Lightning Hash Cracker or LHC is a GPU-based MD5 password cracker. MD5 is a non-reversible cypher algorithm: it’s not possible to get the non-cyphered password from the MD5 password only. So the only solution is to use a brute force attack: we test all possible passwords that once MD5-cyphered will satisfy the following equation:

if (MD5(password) == password_MD5)
{
	// Password found!
}

I’ve prepared a zip file with all you need inside:
[download#24#image]
Just unzip the file in a folder and start test.bat. I’ve coded a tiny exe called timer.exe with the unique purpose to display the time. It is called at the beginning and at the end of the test.

The test will crack 4 passwords stored in a file called test-jegx.md5:

user00_w7Jubi:f10fc7de58eb2fd9e9c9af208ee17f8c
user01_IZftSv:7816e9634f7d6b1d2d77c0bb7b5ac386
user02_Rhwps1:504ae5757bb7a602d2d54a25659b522a
user03_Ikv74X:d272df3ff99269d0cf6b875f604c4c2e

Each line has the following format:
user:password_MD5

Remark: during the test, don’t try to use your computer. The display won’t react because the GPU is too much busy with passwords cracking…

I did the test with two graphics cards and the ForceWare 180.48 WHQL graphics driver:

• GeForce GTX 280
  – 502 millions passwords / second
  – START: 14:14:13 – END: 14:15:52 – Duration: 1 min and 39 sec
• GeForce 8800 GTX
  – 283 millions passwords / second
  – START: 14:31:00 – END: 14:33:53 – Duration: 2 min and 53 sec

We see the performance of GeForce GTX 280 is about twice the GeForce 8800 GTX one. This is easily understandable if we look at the number of shader processors (or core) of each graphics card:
– 240 cores for the GeForce GTX 280
– 128 cores for the GeForce 8800 GTX

But to complete that test, the CPU version of LHC (or an equivalent software) should be used too in order to compare GPU and CPU performance. But I don’t have such a software right now. I tried to start LHC on a computer with a Radeon, thinking that LHC will switch to CPU only, but the only thing I get is an error message about CUDA. LHC uses CUDA technology and LHC initialization step calls some CUDA functions that fail due to the Radeon.

All GeForce 8, GeForce 9 and GeForce GTX 260/280 based graphics cards can be used in this test. So if you have such a graphics card, don’t hesitate to do the test and post your results…

For french readers only: Casser les Mots de Passe MD5 avec une Carte Graphique GeForce @ Geeks3D VF