Re:The curious case of the Raspberry Pi in the network closet
by angry_octet on Thursday January 17, 2019 @07:46PM
(#18936068)
The hash method (SHA1 iterated 4096 times) is quite secure for this purpose. Even md4 would be fine. Of course, lots of Bitcoin ASICs are designed to compute SHA256 fast, but they are very fixed function and lacking the bandwidth to a CPU to stream in passwords. Also, they are just a constant factor better than what a GPU can do. I'm sure the NSA and other peers have rooms full of ASICs devoted to WPA2 though.
A good GPU cracker rig will get 500k hashes/second per GPU. That is still very slow compared to the search space of a 12 character [a-z][A-Z][0-9][@#$_&-+*"':;!?~|{}%] password.
For a 6 character string, it still depends on what mask you are providing, or what the search space is, i.e are there requirements like one or more upper, 1 or more digits, or is it purely random from a RNG?
Still, if it isn't breaking it within a day I'd say you are in CPU mode, where a multicore box is still only 5k hashes/second.
How quickly, really? I remember a while ago I had a discussion on here where someone told me a hash method was insecure, as you could crack it with a GPU. I downloaded hashcat, put in the hash of a 6 character string, and left it running overnight on a GTX1070 and it was still going.