Eight RTX 4090s Can Break Passwords in Under an Hour

[grb]

This is 2-year old news.

@Herc

Says that thing has 24 GB of memory, so I’m not sure how effective Argon’s memory hardness is against an army of those. Probably barely feels any drag from an Argon memory parameter of 500 MB?

GPUs are fast, not because of their memory, but because the large number of processing cores working in parallel to speed up a task. The RTX 4090 has 16,384 cores. If the Argon2id algorithm requires 500 MB (0.5 GB) of memory, then 24 GB of memory only provides enough work space for 48 cores to be performing computations simultaneously (48×0.5 GB = 24 GB). So the computing capacity of the RTX 4090 has been reduced to 48/16385 = 0.3% of its maximum processing power. That’s a pretty significant reduction.

Besides, even using Bitwarden’s default KDF configuration (600,000 iterations of PBKDF2-SHA256), a single RTX 4090 can only test 15,000 password guesses per second. If you wanted to crack a 4-word passphrase in under an hour, you would need an “army” of 68 million RTX 4090 GPUs (an acquisition cost of over 100 billion dollars in hardware).