BF2: A Bloom-Filtered Brute-Force Framework for Multi-Target Password Recovery
Open accessAbstract
Password-based authentication remains widespread, and large-scale sets of leaked hashes enable practical offline brute-force attacks. Multi-target attacks, which check candidates against large sets of hashes simultaneously, are particularly effective. Understanding the capabilities of low-cost platforms for such attacks is important to assess real-world password security risks. Therefore, we present BF2, a modular and scalable FPGA–CPU framework that accelerates multi-target password recovery. BF2 combines a password-candidate generator, a fully-pipelined NT hash core, a Bloom filter stage to filter non-matching candidates, and a multi-threaded host-side component that performs exact membership check using a perfect hash function. We implement BF2 on the low-cost, 199 NiteFury II board. With 16 parallel pipelines running at a 100 MHz clock frequency, our FPGA implementation generates 1.6×10^9 hashes/s. In our experiments, BF2 demonstrates up to 7.5× higher throughput than John the Ripper, and reduces power consumption by as much as 90% compared to Hashcat on an RTX 5000.
AI snapshot
Written from the paper’s full text.
TL;DR
BF2 is a modular FPGA-CPU framework for multi-target NT-hash password recovery that uses a fully pipelined MD4 core and an on-FPGA Bloom filter for early rejection, with exact verification offloaded to the host. On a low-cost NiteFury II board it reaches 1.6×10^9 hashes/s and improves throughput and energy efficiency over CPU and GPU baselines in the evaluated workloads.
Key findings
- With 16 parallel pipelines at 100 MHz on the $199 NiteFury II, BF2 generates 1.6×10^9 hashes/s and achieves end-to-end throughput close to the FPGA theoretical peak in the reported configurations.
- BF2 achieves 4–7.5× higher throughput than John the Ripper; for lowercase 8-character passwords with 1000 targets it reaches 1594.9 MH/s versus 235.6 MH/s for JtR, with about 80 MH/J versus about 12 MH/J.
- Compared with Hashcat on an RTX 5000, BF2 uses about 80% lower power for 5-character printable ASCII and about 90% lower power for 8-character lowercase, while Hashcat has higher raw hash throughput.
- Bloom filter tuning matters: for 10^3 targets and a 4096-bit filter, execution time is shortest at k=3 (54 s), matching expected false-positive behavior.
Methods
- Design and implementation: FPGA-CPU architecture with password-candidate generator, fully pipelined NT/MD4 hash core, per-pipeline Bloom filter, BRAM hit queue, and host-side SIMD MD4 recomputation plus CHD perfect-hash exact verification; implemented on NiteFury II (XC7A200T) with Vivado 2023.1 and a PCIe Gen3 host running Ubuntu on an Intel Core i7-1255U.
- Evaluation: mask-based brute-force experiments varying Bloom filter size, number of Bloom filter indices k, target-set size, password length (5–8), and character set; compared against Hashcat v6.2.5 on an NVIDIA Quadro RTX 5000 with CUDA 12.2 and JtR jumbo parallelized across 12 CPU threads.
- Measurements: throughput and execution time, plus average power from nvidia-smi for GPU, Intel RAPL for CPU, and Vivado estimate for FPGA on-chip power.
Limitations
- Stated: the fixed-size Bloom filter saturates as the number of target hashes grows; beyond a threshold false positives approach 1, the host recomputes all generated hashes, and BF2 performance drops.
- Stated: the design is evaluated on a single low-cost FPGA, with Bloom filter size limited to 32768 bits on NiteFury II; scaling to larger filters or multi-FPGA deployments is left to future work.
- Evident from the text: experiments use synthetic target sets and focus on NT hashes/MD4, with a limited set of password-length and character-set examples, so generality to other hash schemes and real credential distributions is not established.
Model-written summary. Check it against the paper before relying on it.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
0 of 19 cited sources checked · 0 supported · 0 flagged
- Findingown data
BF2 reduces power consumption by as much as 90% compared to Hashcat on an RTX 5000.
“reduces power consumption by as much as 90% compared to Hashcat on an RTX 5000.”
Quote in the paperSubstantial claim- The authors state this as an assumption: An offline attacker is given a set of target NT hashes and tests password candidates by computing their hashes and checking membership against the target set.
- Findingreasoning
With 16 parallel pipelines running at a 100 MHz clock frequency, the FPGA implementation generates 1.6 × 10^9 hashes/s.
“With 16 parallel pipelines running at a 100 MHz clock frequency, our FPGA implementation generates 1.6 × 10 9 hashes/s.”
Quote in the paperSubstantial claim- The authors state this as an assumption: An offline attacker is given a set of target NT hashes and tests password candidates by computing their hashes and checking membership against the target set.
- Findingown data
BF2 demonstrates up to 7.5× higher throughput than John the Ripper.
“In our experiments, BF 2 demonstrates up to 7.5× higher throughput than John the Ripper”
Quote in the paperSubstantial claim- The authors state this as an assumption: An offline attacker is given a set of target NT hashes and tests password candidates by computing their hashes and checking membership against the target set.
- Findingown data
Compared to Hashcat running on an RTX 5000, BF2 achieved 80% lower power consumption for 5-character ASCII passwords.
“Compared to Hashcat running on an RTX 5000, BF 2 achieved 80% lower power consumption for 5-character ASCII passwords and 90% lower power consumption for 8-character lowercase passwords.”
Quote in the paperSubstantial claim - Findingown data
LUT and FF utilization changes only slightly across evaluated BF sizes due to address and control logic differences.
“Bloom filter BRAM consumption remains constant across the BF sizes that we evaluate, while LUT and FF utilization changes only slightly due to address and control logic differences.”
Quote in the paperNot a substantial claim
- Findingown data
LUT and FF utilization increase slightly with longer passwords in the FPGA-only configuration.
“LUT and FF utilization increase slightly with longer passwords, while BRAM usage is the same across PWD_SIZE = [5-8].”
Quote in the paperNot a substantial claim - Findingreasoning
The FPGA-only design with 16 pipelines at 100 MHz sustains a constant throughput of 1600 MH/s (1.6×10^9 hashes/s).
“With 16 pipelines operating at 100 MHz, the design sustains a constant throughput of 1600 MH/s.”
- Also stated in: § 6 Conclusion and Future Work · plain
“We used the low-cost NiteFury II board running at a 100 MHz clock frequency for our evaluations, achieving 1.6 × 10 9 hashes/s.”
Quote in the paperSubstantial claim - Also stated in: § 6 Conclusion and Future Work · plain
- Findingown data
Compared to Hashcat running on an RTX 5000, BF2 achieved 90% lower power consumption for 8-character lowercase passwords.
“Compared to Hashcat running on an RTX 5000, BF 2 achieved 80% lower power consumption for 5-character ASCII passwords and 90% lower power consumption for 8-character lowercase passwords.”
Quote in the paperSubstantial claim - Findingown data
BF2 was evaluated with different Bloom filter sizes and numbers of hash indices, showing a trade-off between false positives and execution time.
“We evaluated BF 2 with different Bloom filter sizes and numbers of hash indices, and showed the trade-off between false-positives and execution time.”
Quote in the paperSubstantial claim - Findingreasoning
BRAM usage is dominated by the Bloom filter because each parallel pipeline instantiates its own Bloom filter.
“On the other hand, BRAM usage is dominated by the Bloom filter, since each parallel pipeline instantiates its own Bloom filter to support high-throughput membership checks.”
Quote in the paperNot a substantial claim - Findingown data
Bloom filter BRAM consumption remains constant across the evaluated BF sizes.
“Bloom filter BRAM consumption remains constant across the BF sizes that we evaluate, while LUT and FF utilization changes only slightly due to address and control logic differences.”
Quote in the paperNot a substantial claim - Findingown data
For the FPGA-only configuration, additional hardware resources to support longer passwords are low.
“For our FPGA-only configuration, the additional hardware resources to support longer passwords are low, as given in Table 3.”
Quote in the paperSubstantial claim - Findingown data
BRAM usage is the same across PWD_SIZE = [5-8] in the FPGA-only configuration.
“LUT and FF utilization increase slightly with longer passwords, while BRAM usage is the same across PWD_SIZE = [5-8].”
Quote in the paperNot a substantial claim - Findingreasoning
BF2 execution time gets longer for a large number of target hashes (Figure 11).
“This behaviour can also be seen in Figure 11 where the execution time gets longer for a large number of target hashes.”
Quote in the paperSubstantial claim - Findingown data
For both 5-character printable ASCII and 8-character lowercase password workloads, BF2 showed up to 7.5× throughput increase compared to JtR.
“For both 5-character printable ASCII and 8-character lowercase password workloads, our design showed up to 7.5× throughput increase compared to JtR.”
Quote in the paperSubstantial claim - Findingown data
Most LUT and FF utilization in the design is due to the fully-pipelined MD4 calculation.
“We can see that most of the LUT and FF utilization is due to our fully-pipelined MD4 calculation.”
Quote in the paperNot a substantial claim - Findingnone given
For 8-character passwords, the FPGA-only configuration reduces power consumption by approximately 98% relative to the Hashcat GPU baseline.
“For 8-character passwords, the power consumption is reduced by approximately 98% relative to the Hashcat GPU baseline.”
Quote in the paperSubstantial claim - Premisenone given
For multi-target workloads, large target sets rarely fit in the FPGA's on-chip memory.
“However, for multi-target workloads, large target sets rarely fit in the FPGA's on-chip memory.”
Quote in the paperNot a substantial claim - Interpretationreasoning
Efficient membership testing becomes as critical as hash-computation throughput for multi-target password recovery.
“As a result, efficient membership testing becomes as critical as hash-computation throughput for multi-target password recovery.”
Quote in the paperSubstantial claim - Premisenone given
Bloom filters offer a significant space advantage by having a representative array of the elements.
“Although Bloom filters are probabilistic and have false positives, they offer a significant space advantage by having a representative array of the elements.”
Quote in the paperSubstantial claim - Study design and conductreasoning
The password generation logic ensures that the entire search space is exhausted.
“This logic ensures that the entire search space is exhausted.”
Quote in the paperSubstantial claim - Interpretationnone given
The throughput of the CPU pipeline constrains the throughput of the FPGA pipeline, as backpressure in verifying hashes stalls candidate generation due to limited PCIe queue memory.
“The throughput of the CPU pipeline constrains the throughput of the FPGA pipeline, as backpressure in verifying hashes stalls candidate generation due to limited PCIe queue memory.”
Quote in the paperNot a substantial claim- The authors state this as an assumption: An offline attacker is given a set of target NT hashes and tests password candidates by computing their hashes and checking membership against the target set.
- Interpretationreasoning
The single-target configuration eliminates Bloom filter programming and BRAM buffering overhead.
“This eliminates Bloom filter programming and BRAM buffering overhead.”
Quote in the paperNot a substantial claim - Premisecitation
NT hashes remain prevalent in leaked credential datasets due to their historical use in Windows environments.
“We focus on the offline recovery of NT hashes [Mic26], a legacy hash scheme that remains prevalent in leaked credential datasets due to its historical use in Windows environments.”
Quote in the paperSubstantial claim0 of 1 sources checked- cites Mic26
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- Study design and conductreasoning
The pipelined execution allows continuous hashing without any data dependencies.
“These intermediate outputs are registered and passed to the next PE, which allows continuous hashing without any data dependencies, as shown in Figure 5.”
Quote in the paperSubstantial claim - Premisecitation
The evaluation by Tasic et al. shows that Bloom filters offer the best trade-off for large hash sets, enabling fast prefiltering with low memory overhead.
“As discussed in Section 2, the evaluation by Tasic et al. [TVC24] shows that Bloom filters offer the best trade-off for large hash sets, enabling fast prefiltering with low memory overhead.”
Quote in the paperSubstantial claim0 of 1 sources checked- cites TVC24
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- Interpretationreasoning
There is a gap between hash-computation throughput and the effective end-to-end throughput in multi-target FPGA workloads.
“This creates a gap between hash-computation throughput and the effective end-to-end throughput.”
Quote in the paperSubstantial claim - Interpretationreasoning
These space and time advantages make Bloom filters particularly suitable for prefiltering before a more expensive exact verification step.
“These space and time advantages make Bloom filters particularly suitable for applications requiring prefiltering before a more expensive exact verification step.”
Quote in the paperSubstantial claim - Interpretationreasoning
As the target set grows, smaller Bloom filters increase the false-positive rate and therefore the host verification load and queue pressure.
“As the target set grows, smaller filters increase the false-positive rate and, therefore, the host verification load and queue pressure.”
Quote in the paperSubstantial claim- The authors state this as an assumption: An offline attacker is given a set of target NT hashes and tests password candidates by computing their hashes and checking membership against the target set.
- Premisereasoning
Wiemer and Zimmermann's architecture is limited to single-target search.
“Yet, their architecture is limited to single-target search.”
Quote in the paperSubstantial claim - Interpretationreasoning
Beyond a certain threshold, the Bloom filter false-positive probability approaches 1, causing the host to recompute all generated hashes.
“Beyond a certain threshold, the probability of false-positives approaches 1, causing the host to recompute all generated hashes.”
Quote in the paperSubstantial claim - Interpretationreasoning
By leveraging FPGA parallelism for computationally intensive operations and CPU for large-scale verification, the hybrid approach addresses limitations inherent to single-platform solutions.
“By leveraging FPGA parallelism for computationally intensive operations and CPU for large-scale verification, the hybrid approach addresses limitations inherent to single-platform solutions.”
Quote in the paperSubstantial claim - Interpretationreasoning
The number of parallel pipelines n can be scaled depending on available FPGA resources, thereby reducing password recovery time.
“The number of parallel pipelines, n, can be scaled depending on the available FPGA resources, thereby reducing the password recovery time.”
Quote in the paperSubstantial claim - Interpretationreasoning
With a fixed-size Bloom filter and an increasing number of target hashes, the filter gradually saturates.
“Since we use a fixed-size Bloom filter with an increasing number of target hashes, the filter gradually starts to saturate.”
Quote in the paperSubstantial claim - Interpretationreasoning
Implementing BF2 on larger FPGAs with additional resources can sustain a lower false-positive rate by using larger Bloom filters.
“Therefore, implementing BF 2 on larger FPGAs with additional resources can sustain a lower false-positive rate by using larger Bloom filters.”
Quote in the paperSubstantial claim - Interpretationreasoning
The worst-case recovery time for the FPGA-only mode is s/(n f_clk), where s is the search-space size, n is the number of pipelines, and f_clk is the FPGA clock frequency.
“T worst = s n f clk , T avg ≈ s 2 n f clk .(7)”
Quote in the paperSubstantial claim - Interpretationreasoning
In FPGA-only mode, throughput is determined solely by the FPGA clock frequency and the number of parallel pipelines, equal to n × f_clk.
“Throughput is only determined by the FPGA clock frequency and the number of parallel pipelines.”
- Also stated in: § FPGA-only single-target mode. · plain
“the throughput is n × f clk , where f clk is the FPGA clock frequency.”
Quote in the paperSubstantial claim - Also stated in: § FPGA-only single-target mode. · plain
- Interpretationown data
These results demonstrate that BF2 is a power-efficient alternative for energy- or cost-constrained scenarios.
“These results demonstrate that BF 2 is a power-efficient alternative for energy or cost constrained scenarios.”
Quote in the paperSubstantial claim - Interpretationreasoning
BF2 can scale from compact, energy-efficient implementations on small, low-cost FPGAs to high-throughput configurations on larger devices.
“This allows BF 2 to scale from compact, energy-efficient implementations on small, low-cost FPGAs to high-throughput configurations on larger devices.”
Quote in the paperSubstantial claim - Interpretationreasoning
The average recovery time for the FPGA-only mode is approximately s/(2 n f_clk), assuming uniformly distributed target hashes.
“T worst = s n f clk , T avg ≈ s 2 n f clk .(7)”
Quote in the paperSubstantial claim- The authors state this as an assumption: Target hashes are uniformly distributed over the search space.
- Interpretationreasoning
The time to recover a given password is directly proportional to its position in the deterministic fixed-order search order across n parallel pipelines.
“Since our password generation module generates the candidates deterministically and in a fixed order across n parallel pipelines, the time to recover a given password is directly proportional to its position in the search order.”
Quote in the paperNot a substantial claim
- May combine two claims. 21
- The quote only partly states this claim. 1
- Classified as probably not a substantial claim. 27
May combine two claims. The quote only partly states this claim.
FindingreasoningThe core_id partitioning enumerates Char 0 in n-wide blocks, enumerating a superset of the alphabet for Char 0.
“The core_id partitioning keeps the generator lightweight, but it enumerates Char 0 in n-wide blocks due to the hardcoded core_id.”
Quote in the paperSubstantial claimMay combine two claims.
Findingown dataPower consumption increases with password length but stays under 4 W for the evaluated FPGA-only configurations.
“Power consumption increases depending on the password length, but stays under 4 W for the evaluated configurations.”
Quote in the paperNot a substantial claimMay combine two claims.
InterpretationreasoningLarger Bloom filters reduce the host verification overhead with a lower false-positive rate.
“Larger filters reduce this overhead with a lower false-positive rate.”
Quote in the paperSubstantial claim- The authors state this as an assumption: An offline attacker is given a set of target NT hashes and tests password candidates by computing their hashes and checking membership against the target set.
May combine two claims.
PremisereasoningTasic et al.'s implementation is limited to software-based evaluation and does not address integration into a deeply pipelined FPGA datapath.
“However, their implementation is limited to software-based evaluation and does not address integration into a deeply pipelined FPGA datapath or the resulting trade-offs between host and FPGA at very high candidate rates.”
Quote in the paperSubstantial claimClassified as probably not a substantial claim.
PremisereasoningMulti-target attacks require set membership testing.
“Unlike single-target attacks that compare each digest against a fixed value, multi-target attacks require set membership testing.”
Quote in the paperSubstantial claimProbably not a substantial claim: may not pass S4 (based).
Premisenone givenGPUs do so at high power and cost, which can be limiting in energy and cost constrained settings.
“However, they do so at high power and cost, which can be limiting in energy and cost constrained settings.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S4 (based).
Interpretationnone givenThe one-time Bloom filter programming overhead is negligible compared to the password recovery runtime.
“This one-time initialization overhead is negligible compared to the password recovery runtime.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S3 (load-bearing), S4 (based).
Premisenone givenIn multi-target settings, Hashcat uses a bitmap-style prefilter similar to Bloom filters, which generates a bitmap using parts of the hash digests.
“In multi-target settings, Hashcat uses a bitmap-style prefilter similar to Bloom filters, which generates a bitmap using parts of the hash digests.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S4 (based).
Premisenone givenThere is no prior work that integrates a Bloom filter-based early rejection mechanism directly on FPGAs as part of the password recovery pipeline.
“To the best of our knowledge, there is no prior work that integrates a Bloom filter-based early rejection mechanism directly on FPGAs as part of the password recovery pipeline.”
Quote in the paperNot a substantial claimMay combine two claims.
Study design and conductown dataThe design preserves the Bloom filter mechanism since the NT hash provides well-distributed bits, confirmed by evaluation varying m and k.
“This preserves the Bloom filter mechanism since the NT hash already provides well-distributed bits, which our later evaluation confirms in Subsection 5.5 by varying m and k.”
Quote in the paperSubstantial claim- Rests on an assumption: Hashes already contain sufficient entropy for deriving a Bloom filter from their bits.
Probably not a substantial claim: may not pass S4 (based).
Premisenone givenMulti-target attacks, which check candidates against large sets of hashes simultaneously, are particularly effective.
“Multi-target attacks, which check candidates against large sets of hashes simultaneously, are particularly effective.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S3 (load-bearing).
PremisecitationZhang and Liu demonstrate a CPU-FPGA hybrid brute-force attack on sha256crypt achieving 2.54× energy efficiency compared with Hashcat on GTX 1080 Ti.
“Zhang and Liu [ZL20] demonstrate a CPU-FPGA hybrid brute-force attack on the sha256crypt algorithm, implemented on a custom-made board.They achieve 2.54× energy efficiency compared with Hashcat running on GTX 1080 Ti GPU.”
Quote in the paperNot a substantial claim0 of 1 sources checked- cites ZL20
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
May combine two claims.
Interpretationnone givenBF2 combines a password-candidate generator, a fully-pipelined NT hash core, a Bloom filter stage to filter non-matching candidates, and a multi-threaded host-side component that performs an exact membership check using a perfect hash function.
“BF 2 combines a password-candidate generator, a fully-pipelined NT hash core, a Bloom filter stage to filter non-matching candidates, and a multi-threaded host-side component that performs an exact membership check using a perfect hash function.”
Quote in the paperSubstantial claimMay combine two claims.
PremisereasoningA Bloom filter query checks k bit positions, with a lookup cost of O(k) that is independent of the number of inserted elements.
“A Bloom filter query checks k bit positions, which has a lookup cost of O(k).The lookup cost is independent of the number of inserted elements (and constant for fixed k).”
Quote in the paperSubstantial claimProbably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.
PremisecitationAbbas et al. demonstrate multi-FPGA acceleration for TrueCrypt container recovery using RIVYERA S6-LX150 with 128 Spartan6-LX150 FPGAs, showing speed-up over CPUs and lower energy per password.
“Similarly, for PBKDF2-based attacks, Abbas et al. [AVWS14] demonstrate multi-FPGA acceleration in the context of TrueCrypt container recovery using RIVYERA S6-LX150, containing 128 Spartan6-LX150 FPGAs.They show a notable speed-up compared to high-end CPUs and lower energy consumption per password, compared to CPUs and GPUs.”
Quote in the paperNot a substantial claim0 of 1 sources checked- cites AVWS14
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
May combine two claims.
InterpretationreasoningBF2's FPGA-CPU co-design avoids storing large target sets in the FPGA on-chip memory and reduces host transfer and verification workload.
“This FPGA-CPU co-design avoids storing large target sets in the FPGA on-chip memory and reduces host transfer and verification workload.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S3 (load-bearing).
Interpretationnone givenThe PHF parameters affect only the PHF construction and memory usage, not the lookup procedure used during runtime.
“These parameters affect only the PHF construction and memory usage, not the lookup procedure used during runtime.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S3 (load-bearing).
PremisecitationIn standard Bloom filters, the k hash functions are assumed to be independent and uniformly distributed.
“In standard Bloom filters, the k hash functions are assumed to be independent and uniformly distributed [LGM + 19].”
Quote in the paperNot a substantial claim0 of 1 sources checked- cites LGM + 19
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
Classified as probably not a substantial claim.
PremisecitationThe probability of a false positive in a Bloom filter depends on the size of the bit array m, the number of hash functions k, and the number of inserted elements N.
“The probability of a false positive in a Bloom filter depends on the size of the bit array m, the number of hash functions k, and the number of inserted elements N .”
Quote in the paperSubstantial claimMay combine two claims.
Interpretationnone givenBF2 places the early-rejection stage after a high-throughput NT hash core in the FPGA, while offloading exact verification to the host.
“BF 2 places this early-rejection stage after a high-throughput NT hash core in the FPGA, while offloading the exact verification to the host.”
Quote in the paperSubstantial claimMay combine two claims.
Study design and conductreasoningThe backpressure mechanism guarantees the transfer of Bloom filter positives without loss and prevents overwriting unread BRAM entries.
“To guarantee the transfer of Bloom filter positives without loss and to prevent overwriting unread BRAM entries, we implement a lightweight backpressure mechanism controlled by two counters: write_count and read_count.”
Quote in the paperSubstantial claimProbably not a substantial claim: may not pass S4 (based).
Premisenone givenIn large target sets, set membership testing can become a bottleneck due to limited on-chip memory, irregular off-chip accesses, and bandwidth constraints.
“In large target sets, set membership testing can become a bottleneck due to limited on-chip memory, irregular off-chip accesses, and bandwidth constraints.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S3 (load-bearing).
PremisecitationTasic et al.'s results show that Bloom filters provide a favorable trade-off between speed, memory consumption, and the probability of false positives.
“Their results show that Bloom filters provide a favorable trade-off between speed, memory consumption, and the probability of false positives.”
Quote in the paperNot a substantial claim0 of 1 sources checked- cites TVC24
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
Probably not a substantial claim: may not pass S3 (load-bearing).
InterpretationreasoningThe 80% load factor oversizes the target table by 20%, which provides additional space to ease the PHF construction.
“The 80% load factor oversizes the target table by 20%, which provides additional space to ease the PHF construction.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S3 (load-bearing).
Premisenone givenGPUs have a very high throughput in password recovery because they are specifically designed for parallel processing.
“GPUs have a very high throughput in password recovery because they are specifically designed for parallel processing.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S3 (load-bearing).
PremisecitationFPGA-based acceleration has been applied to password hashing schemes, including bcrypt, PBKDF2, WPA2-Personal, MD5, and sha256crypt, typically by instantiating many parallel cores and carefully managing data dependencies.
“FPGA-based acceleration has also been applied to password hashing schemes, including bcrypt [WZ14], PBKDF2 [AVWS14], WPA2-Personal [KMB + 16], MD5 [GPG19], and sha256crypt [ZL20], typically by instantiating many parallel cores and carefully managing data dependencies.”
Quote in the paperNot a substantial claim0 of 3 sources checked- cites WZ14
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- cites AVWS14
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- cites KMB + 16
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
May combine two claims.
InterpretationreasoningThe host generates a Bloom filter from the target set and programs it onto the FPGA, avoiding on-chip storage of the full target set.
“The host generates a Bloom filter from the target set and programs it onto the FPGA.This avoids on-chip storage of the full target set.”
Quote in the paperSubstantial claim- Rests on an assumption: Hashes already contain sufficient entropy for deriving a Bloom filter from their bits.
Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.
PremisereasoningCPU-only tools are accessible and flexible when handling large target sets in main memory, but they provide substantially lower throughput compared to GPU tools.
“CPU-only tools are accessible and flexible when handling large target sets in main memory, but they provide substantially lower throughput compared to GPU tools.”
Quote in the paperNot a substantial claimClassified as probably not a substantial claim.
PremisereasoningA Bloom filter has no false negatives: if any bit position is 0, the element is guaranteed not to be in the set.
“Otherwise, the element is guaranteed not to be in the set, meaning there are no false negatives.”
Quote in the paperSubstantial claimClassified as probably not a substantial claim.
PremisecitationAssuming independent and uniformly distributed hash functions, the false positive probability can be approximated by Equation 1, following the classical analysis of Bloom and Mitzenmacher and Upfal.
“Assuming independent and uniformly distributed hash functions, the false positive probability can be approximated by Equation 1, following the classical analysis of Bloom [Blo70] and Mitzenmacher and Upfal [MU05, §5.5.3].”
Quote in the paperSubstantial claim0 of 2 sources checked- cites Blo70
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- cites MU05
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
Classified as probably not a substantial claim. May combine two claims.
InterpretationreasoningThe host reconstructs all hit candidates by inserting the core-specific bits for the first character according to core_hits, and then performs exact verification.
“The host reconstructs all hit candidates by inserting the core-specific bits for the first character, according to the set bits in core_hits, and then performs exact verification.”
Quote in the paperSubstantial claimProbably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.
PremisecitationMD4's security is now severely compromised, with prior work showing collision and preimage attacks.
“Although MD4 was considered secure, its security is now severely compromised.Prior work has shown various types of attacks, including collision attacks [Dob96,SNKO07] and preimage attacks [GLRW10,AS09], highlighting the vulnerabilities of the MD4 hash function.”
Quote in the paperNot a substantial claim0 of 3 sources checked- cites Dob96
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- cites SNKO07
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- cites GLRW10
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
Probably not a substantial claim: may not pass S3 (load-bearing).
PremisecitationAdvances in specialized hardware such as GPUs, FPGAs, and ASICs have increased brute-force password recovery throughput by exploiting massive parallelism.
“Over the years, advances in specialized hardware such as GPUs, FPGAs, and ASICs have increased brute-force password recovery throughput by exploiting massive parallelism [VHN + 11, MDK14, AAA + 23], as many password hashing algorithms involve repetitive mathematical operations.”
Quote in the paperNot a substantial claim0 of 3 sources checked- cites VHN + 11
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- cites MDK14
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
- cites AAA + 23
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
Probably not a substantial claim: may not pass S3 (load-bearing).
PremisecitationWiemer and Zimmermann demonstrate a high-speed bcrypt search on a low-power Zynq 7020 FPGA, with 40 parallel cores running at 100 MHz.
“For bcrypt, Wiemer and Zimmermann [WZ14] demonstrate a high-speed search on a low-power Zynq 7020 FPGA, with 40 parallel cores running at 100 MHz.”
Quote in the paperNot a substantial claim0 of 1 sources checked- cites WZ14
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.
Premisenone givenFPGAs offer reprogrammability and are available in a wide range of low-cost, low-power devices.
“FPGAs offer reprogrammability and are available in a wide range of low-cost, low-power devices.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S3 (load-bearing), S4 (based).
InterpretationreasoningMD4's structure makes it very suitable for deep pipelining and parallel replication in hardware.
“This structure makes MD4 very suitable for deep pipelining and parallel replication in hardware.”
Quote in the paperNot a substantial claimProbably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.
PremisecitationKammerstetter et al. show an attack on WPA2-Personal with a low-cost FPGA cluster using 36 Spartan-6 FPGAs, showing shorter, low-entropy WPA2 passwords can be broken.
“Kammerstetter et al. [KMB + 16] show an attack on WPA2-Personal with a highlyoptimized low-cost FPGA cluster using repurposed cryptomining boards with 36 Spartan-6 FPGAs, where the password is derived through PBKDF2 in combination with SHA-1.They showed that shorter, low-entropy WPA2 passwords can be broken even with low-cost FPGA solutions.”
Quote in the paperNot a substantial claim0 of 1 sources checked- cites KMB + 16
Couldn’t be matched to a paper in Crossref, so it can’t be checked.
May combine two claims.
InterpretationreasoningExact matching must be performed off-chip, which quickly becomes bandwidth and latency limited.
“Therefore, exact matching must be performed off-chip, which quickly becomes bandwidth and latency limited.”
Quote in the paperSubstantial claimMay combine two claims.
Interpretationnone givenThe FPGA generates password candidates, computes their NT hashes, and performs Bloom filter membership tests, with only Bloom filter hits buffered and transferred to the host for exact verification.
“On the other hand, the FPGA generates password candidates, computes their NT hashes, and performs Bloom filter membership tests.Only the corresponding passwords of Bloom filter hits are buffered in the FPGA's block RAM (BRAM) and transferred to the host, which performs exact verification against the target set.”
Quote in the paperSubstantial claimMay combine two claims.
Interpretationown dataBF2 is a modular and scalable FPGA-CPU framework that accelerates multi-target password recovery.
“we present BF 2 , a modular and scalable FPGA-CPU framework that accelerates multi-target password recovery.”
Quote in the paperSubstantial claimProbably not a substantial claim: may not pass S3 (load-bearing).
Interpretationnone givenThe initial hash pipeline filling stage of about 48 cycles is negligible compared with the operation.
“after the initial hash pipeline filling stage around 48 cycles, which is negligible compared to the operation”
Quote in the paperNot a substantial claimMay combine two claims.
InterpretationreasoningWhen the Bloom filter saturates, it no longer provides effective filtering and BF2 performance starts to drop.
“In this case, the Bloom filter no longer provides effective filtering, and BF 2 performance starts to drop.”
Quote in the paperSubstantial claim
The authors state this as an assumption.
An offline attacker is given a set of target NT hashes and tests password candidates by computing their hashes and checking membership against the target set.
“We assume an offline attacker who is given a set of target NT hashes and tests password candidates by computing their hashes and checking membership against the target set.”
The paper relies on this without support.
Hashes already contain sufficient entropy for deriving a Bloom filter from their bits.
“As hashes already contain sufficient entropy, the Bloom filter is derived from the bits of each hash.”
The authors state this as an assumption.
Target hashes are uniformly distributed over the search space.
“assuming uniformly distributed target hashes”
Cites
Space/time trade-offs in hash coding with allowable errors
Bloom, B. (1970) · CACM · doi:10.1145/362686.362692 · Cited by 8,424 · see citing works
Mitzenmacher, M., & Upfal, E. (2005) · Cambridge University Press eBooks · doi:10.1017/cbo9780511813603 · Cited by 1,739 · see citing works
The MD4 Message Digest Algorithm
Rivest, R. L. (2007) · Springer eBooks · doi:10.1007/3-540-38424-3_22 · Cited by 487 · see citing works
Optimizing Bloom Filter: Challenges, Solutions, and Comparisons
Luo, L., Guo, D., Ma, R. T. B., Rottenstreich, O., & Luo, X. (2018) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2018.2889329 · Cited by 243 · see citing works
Dobbertin, H. (1996) · Lecture notes in computer science · doi:10.1007/3-540-60865-6_43 · Cited by 183 · see citing works
Preimage Attacks on One-Block MD4, 63-Step MD5 and More
Aoki, K., & Sasaki, Y. (2009) · Lecture Notes in Computer Science · doi:10.1007/978-3-642-04159-4_7 · Cited by 182 · see citing works
Guo, J., Ling, S., Rechberger, C., & Wang, H. (2010) · Lecture Notes in Computer Science · doi:10.1007/978-3-642-17373-8_4 · Cited by 127 · see citing works
Belazzougui, D., Botelho, F. C., & Dietzfelbinger, M. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-04128-0_61 · Cited by 125 · see citing works
Breaking Ciphers with COPACOBANA –A Cost-Optimized Parallel Code Breaker
Kumar, S. S., Paar, C., Pelzl, J., Pfeiffer, G., & Schimmler, M. (2006) · Lecture notes in computer science · doi:10.1007/11894063_9 · Cited by 107 · see citing works
Password Cracking with Brute Force Algorithm and Dictionary Attack Using Parallel Programming
Alkhwaja, I., Albugami, M., Alkhwaja, A., Alghamdi, M. A., Abahussain, H., Alfawaz, F., Almurayh, A., & Min‐Allah, N. (2023) · Applied Sciences · doi:10.3390/app13105979 · Cited by 42 · see citing works
UTF-16, an encoding of ISO 10646
Hoffman, P., & Yergeau, F. (2000) · doi:10.17487/rfc2781 · Cited by 39 · see citing works
Are Your Passwords Safe: Energy-Efficient Bcrypt Cracking with Low-Cost Parallel Hardware
Malvoni, K., Designer, S., & Knezović, J. (2014) · doi:10.13140/2.1.3267.0081 · Cited by 29
High-speed implementation of bcrypt password search using special-purpose hardware
Wiemer, F., & Zimmermann, R. (2014) · International Conference on ReConFigurable Computing and FPGAs (ReConFig) · doi:10.1109/reconfig.2014.7032529 · Cited by 26 · see citing works
Improved Collision Attacks on MD4 and MD5
SASAKI, Y., NAITO, Y., Kunihiro, N., et al. (2007) · IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences · doi:10.1093/ietfec/e90-a.1.36 · Cited by 17 · see citing works
Efficient High-Speed WPA2 Brute Force Attacks Using Scalable Low-Cost FPGA Clustering
Kammerstetter, M., Muellner, M., Burian, D., et al. (2016) · Lecture notes in computer science · doi:10.1007/978-3-662-53140-2_27 · Cited by 16 · see citing works
An efficient implementation of PBKDF2 with RIPEMD-160 on multiple FPGAs
Abbas, A., Voss, R., Wienbrandt, L., et al. (2014) · IEEE International Conference on Parallel and Distributed Systems (ICPADS) · doi:10.1109/padsw.2014.7097841 · Cited by 14 · see citing works
A homogeneous parallel brute force cracking algorithm on the GPU
Vu, A.-D., Han, J.-I., Nguyen, H.-A., et al. (2011) · doi:10.1109/ictc.2011.6082661 · Cited by 13 · see citing works
Parallelization of Brute-Force Attack on MD5 Hash Algorithm on FPGA
Gillela, M., Přenosil, V., & Ginjala, V. R. (2019) · International Conference on VLSI Design and International Conference on Embedded Systems (VLSID) · doi:10.1109/vlsid.2019.00034 · Cited by 13 · see citing works
Wienbrandt, L., Baumgart, S., Bissel, J., et al. (2010) · Procedia Computer Science · doi:10.1016/j.procs.2010.04.114 · Cited by 11 · see citing works
Enhancing COPACOBANA for advanced applications in cryptography and cryptanalysis
Güneysu, T. E., Paar, C., Pfeiffer, G., et al. (2008) · International Conference on Field Programmable Logic and Applications (FPL) · doi:10.1109/fpl.2008.4630037 · Cited by 11 · see citing works
A Hybrid-CPU-FPGA-based Solution to the Recovery of Sha256crypt-hashed Passwords
Zhang, Z., & Liu, P. (2020) · IACR Transactions on Cryptographic Hardware and Embedded Systems · doi:10.46586/tches.v2020.i4.1-23 · Cited by 11 · see citing works
Reinforcing cybersecurity with Bloom filters: a novel approach to password cracking efficiency
Tasic, I., Villafranca, A., & Cano, M. (2024) · EURASIP Journal on Information Security · doi:10.1186/s13635-024-00183-2 · Cited by 2 · see citing works
A5/3 make or break: A massively parallel FPGA architecture for exhaustive key search
Miteloudi, K., Batina, L., & Mentens, N. (2025) · IACR Transactions on Cryptographic Hardware and Embedded Systems · doi:10.46586/tches.v2025.i3.361-388 · Cited by 2 · see citing works
A Hybrid-CPU-FPGA-based Solution to the Recovery of Sha256crypt-hashed Passwords
Zhang, Z., & Liu, P. (2020) · IACR Transactions on Cryptographic Hardware and Embedded Systems · doi:10.13154/tches.v2020.i4.1-23
Flagged first, then by citations
Research works printed but not linked: 4
- Openwall, John the Ripper password cracker
- Hashcat Project, Hashcat: Advanced Password Recovery
- Microsoft, 2026, NT LAN Manager (NTLM) Authentication Protocol
- RHS Research LLC, 2022, NiteFury and LiteFury: Xilinx FPGA Development Board Kit in M.2 Form Factor, GitHub repository
- Authors
- Aslan, C., Pünter, W., & Dörr, C.
- Affiliations
- Hasso Plattner Institute (DE)
- Hasso Plattner Institute, University of Potsdam
- Venue
- IACR Communications in Cryptology
- Published
- 2026-08-03
- Volume
- 3
- Issue
- 2
- ISSN
- 3006-5496 (ISSN-L)
- OpenAlex
- W7172345008
- Semantic Scholar
- 57104621575831095b3daab66920c15b004d84b8
- Cited by
- 0
- References
- 22
- FWCI
- 0.00
- Type
- journal article
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- Locations
- IACR Communications in Cryptology (publishedVersion, cc-by)
- Funders
- European Commission (101094901)
- HORIZON EUROPE Framework Programme (101094901)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
- Physical Sciences › Computer Science › Information Systems › User Authentication and Security Systems
- Physical Sciences › Computer Science › Hardware and Architecture › Embedded Systems Design Techniques
- Keywords
- brute force attacks, password cracking, Bloom filter, FPGA implementation, perfect hash functions, password security, hardware acceleration
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-18.
Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-18.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
