hashcat Forum

Hi everyone,
I'm playing with a list of MD5 hashes that have password length of 11 (lowered alpha-numeric) and salt length of 14. I have to attack with md5($salt.$pass)


Because the keyspace is too large 36^11, speed is critical and I noticed in the benchmark result that md5($pass.$salt) has almost the same speed with raw MD5 (-m 0), which nearly double as compare to md5($salt.$pass).

Can someone explain why they are both "half MD5" but so different in speed? Prepend is costly than append?
Is there any other ways to improve this attack?

Thank you!

There's multiple reasons. The way how hashcat exploits some weakness in MD5 to get additional acceleration requires it to change only the first 4 bytes of the input data. Since this part is fixed (because of the salt) it cannot use the acceleration.

For half MD5 it's completely different and therefore a bit confusing how you go from md5(p.s) to half-md5. For half MD5 the hash is not known in full, therefore we can not reverse the internal hash state up to a certain point to do the early reject.

Thanks Atom for correcting me.
Guess I have to wait