Why am I getting only 800 hashes per second?

Question

I was trying to crack a 6 character long password, but even after 10 minutes, it showed no progress. So, i decided to find how many hashes am I finding per second.

The following code need to crack the password, which is 'zzzz', h is the hash given by crypt, while s is the salt and hashing algorithm used.

import crypt
#zzzz
h='$6$XR2ZpTWwyJL90BVD$HpFiwwuLyHOVbWnk/G/gUW.Hz0SutY4F9io4zjWkLL8bK6F3A4WCdSWQNgtq8fTx6PuzM1cdyQdlN2Qv/HlzH.'
s = '$6$XR2ZpTWwyJL90BVD$'

def brute(hash, salt, charSet="abcdefghijklmnopqrtuvxyz"):
    # for pwd_len in range(7):
    for guess in product(charSet,repeat= 4):
        guess=''.join(guess)
        if hash == crypt.crypt(guess,salt):
            return guess
    return -1        

print(brute(h, s))

This is 456,976 hashes, but the time taken to crack the password is 9 minutes and 20 seconds, which is extremely slow. I know that single threading isn't ideal but isn't it still very low?

Answer 1

The crypt module, like the crypt() system call that underlies it, is meant for hashing passwords, and good password hashing algorithms are designed to be slow, precisely because they want to make it difficult for hackers do exactly what you're trying to do here.

In your case, if you generated your salt using the default arguments to crypt.mksalt(), each call to crypt.crypt() runs 5000 iterations of SHA-512, so your program actually computes 2284880000 individual SHA-512 hashes in the ten minutes it takes to brute-force this password. That should sound more reasonable!

You might want to experiment with changing the number of rounds passed to mksalt() to see how it affects the computation time.