6

I am looking for CPU, GPU and/or ASIC performance stats on hash performance. Specifically SHA256 and Argon2i. I've googled and only came up with very limited anecdotal evidence. Considering that this fast-changing field is so important for security managers, I would expect there to be a resource that provides the latest benchmarks in this area. Does such a thing exist?

Steffen Ullrich
  • 184,332
  • 29
  • 363
  • 424
mkoistinen
  • 161
  • 1
  • 3
  • how does sha2 hashing speed affect security? – dandavis Jan 08 '17 at 17:00
  • 1
    @dandavis, some SHA-2 algorithms are used for password hashing, with a tuneable number of iterations. Without knowing how fast a dictionary attack can be, it’s hard to know how many iterations you need. – Tom Zych Jan 08 '17 at 19:17
  • A well implemented system that uses pw-based security will use a system of hashing whereas the password and a salt are hashed many thousands of times ("work factor") before they are stored. The idea is that if these pw-hashes are obtained by an attacker, it will require a lot of CPU work/time to brute-force all the passwords from these hashes. Knowing the GPU/ASIC speed of brute-forcing is helpful in designing security policies––especially password expiration policies. – mkoistinen Jan 08 '17 at 21:16
  • It is now 2 years 1 month since this was asked; a google search still fails to turn up much of use. Did you ever manage to find anything? It is hard to believe that there is simply no information on this. – Malcolm MacLeod Feb 27 '19 at 21:52

1 Answers1

3

In June 2016, Jeremi M. Gosney (the guy behind sagitta HPC) published the results obtained with their top-end password cracker, running Hashcat v3.00-beta: https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40

This list contains all hashing functions implemented by Hashcat which, unfortunately, doesn't support Argon2i yet.

Regarding SHA256, the results are:

Speed.Dev.#1.:  2865.2 MH/s (96.18ms)
Speed.Dev.#2.:  2839.8 MH/s (96.65ms)
Speed.Dev.#3.:  2879.5 MH/s (97.14ms)
Speed.Dev.#4.:  2870.6 MH/s (96.32ms)
Speed.Dev.#5.:  2894.2 MH/s (96.64ms)
Speed.Dev.#6.:  2857.7 MH/s (96.78ms)
Speed.Dev.#7.:  2899.3 MH/s (96.46ms)
Speed.Dev.#8.:  2905.7 MH/s (96.26ms)
Speed.Dev.#*.: 23012.1 MH/s
ATo
  • 316
  • 1
  • 5
  • Thanks, this is precisely the "limited anecdotal evidence" I was speaking of =) – mkoistinen Jan 09 '17 at 15:59
  • I see... Well, I don't think it has been much advancement since then. The GTX 1080 remains the top-notch GPU today. You might ask on Hashcat forums or Jeremy directly. Please keep us posted if you find anything interesting :) – ATo Jan 10 '17 at 01:30