The NVIDIA GeForce RTX 4090 isn’t only great for gaming, but it also functions pretty well as a password cracker, according to a recent tweet from security researcher Sam Croley that offers insight on the GPU’s cryptography capabilities. Green team’s flagship Ada Lovelace option for gamers apparently provides twice the performance over the GeForce RTX 3090 for “nearly every algorithm,” an improvement that has prompted researchers to estimate that a system leveraging eight GeForce RTX 4090 graphics cards could crack any eight-character password in 48 minutes. NVIDIA’s GeForce RTX 4090, which the company has described as “beyond fast,” is available now starting at $1,599.
First @hashcat benchmarks on the new @nvidia RTX 4090! Coming in at an insane >2x uplift over the 3090 for nearly every algorithm. Easily capable of setting records: 300GH/s NTLM and 200kh/s bcrypt w/ OC! Thanks to blazer for the run. Full benchmarks here: https://t.co/Bftucib7P9 pic.twitter.com/KHV5yCUkV4
— Chick3nman 🐔 (@Chick3nman512) October 14, 2022
From a Tom’s Hardware report:
This is likely the result of Nvidia still investing a lot of its graphics chip design development to increase its performance on the data-center side. The RTX 4090 shone across the several attack types provided in the HashCat software: dictionary attacks, combinator attacks, mask attacks, rule-based attacks, and brute force attacks.
The researchers estimate that a purpose-built password hashing rig (pairing eight RTX 4090 GPUs) could crack an eight-character password in 48 minutes. According to Statista and from 2017 data, 8-character passwords are the most common among leaked passwords, commanding a 32% share of them. This doesn’t mean that they’re the least safe; it just very likely means that it’s the most common password character length. And they can now be taken out in under an hour by a “specialized” hashing rig.
Of course, that assumes that the password is as least eight characters long and that it follows the required conventions (at least one number and a special character included). When HashCat is driven to test the most commonly used passwords, however, it can bring a theoretical 48 minute cracking operation that attempted all 200 billion possible combinations down to the millisecond range.