Most password protection methods rely on multiple rounds of hash iterations to slow down brute-force attacks. Even the fastest processors choke when trying to break a reasonably password. Video cards can be used to speed up the recovery with GPU acceleration, yet the GPU market is currently overheated, and most high-end video cards are severely overpriced. Today, we’ll test a bunch of low-end video cards and compare their price/performance ratio.

Making use of GPU cores instead of the CPU helps break passwords faster. Even the slowest built-in GPU with a TDP of several watts may demonstrate performance comparable to a 190W CPU without a sweat. High-end GPUs such as the NVIDIA RTX 3080 can break passwords up to 500 times faster compared to a common Intel Core i7 CPU, while mid-range video cards delivering up to a 250x boost.

GPU acceleration offloads computational-intensive calculations from the computer’s CPU onto the video card’s Compute Units (CUs). A dedicated video card can deliver the speed far exceeding the metrics of a high-end CPU. Even a modest integrated GPU (the one built into a CPU) may be able to match or exceed the performance of the central processor while consuming significantly less electricity and dissipating a fraction of the heat produced by the CPU with similar load.

The price of GPU acceleration

The entire GPU market today is badly overheated, and that isn’t exactly AMD’s or Nvidia’s fault. Due to the high performance, high-performance video cards are consumed by crypto miners, driving the prices of all but the lowest-performing video cards to the sky. We first tried to address the situation by developing heterogeneous GPU acceleration, which is a technology that allows simultaneous use of multiple video cards of different makes and models in the same computer. The technology (built into Elcomsoft Distributed Password Recovery) allows users to effectively utilize existing hardware in mix-and-match scenarios, utilizing video cards of different makes, models, and generations.

Unfortunately, the crypto craze continued driving the prices of video cards up, making even mid-range video cards out of the reach of an average consumer. What’s left on the market are the lowest-performing cards that cannot be economically used for mining cryptocurrencies, as well as integrated GPUs built into many modern processors. Today, we’ll be testing their performance in an attempt to discover a password recovery acceleration unit with acceptable price-performance ratio.

We’ll be testing several hardware configurations in multiple scenarios. The configurations are:

1. CPU only: Intel i7-9700K system with no GPU.
2. Integrated graphics: the same system but using Intel’s built-in UHD Graphics 630.
3. Integrated graphics: AMD Radeon Vega 8 Graphics built into the AMD Ryzen 7 5700G.
4. Dedicated graphics: NVIDIA T600.
5. Dedicated graphics: NVIDIA 1650.

While the systems use different CPUs, this only matters for CPU-only benchmarks. GPU-accelerated attacks put very little load onto the CPU (approximately 3 to 6 per cent utilization per CPU core), which makes such tests pretty much CPU-agnostic.

We struggled to get a copy of NVIDIA RTX 3050 for benchmarking, yet we could not source one for a reasonable price (<400€). We’ll update the article once that card becomes available.

Intel UHD Graphics 630

The Intel UHD Graphics 630 (GT2) is an integrated GPU of the Coffee Lake generation or processors. The version of the GPU built into the Intel(R) Core(TM) i7-9700K CPU offers 24 Compute Units (CUs) and clocks at 1200 MHz. This GPU has no dedicated graphics memory and relies on the system memory (4x16GB DDR4 modules @ 3000MT/s installed in our system).

AMD Radeon RX Vega 8

The AMD Radeon RX Vega 8 is an integrated GPU in the Ryzen 5000 series processors. In our case, it is part of the AMD Ryzen 7 5700G CPU. The GPU is based on the Vega architecture announced way back in August 2017 and has 8 Compute Units (CUs) clocked at 2000 MHz. Just like above, this GPU has no dedicated graphics memory and relies on the system memory (2x8GB DDR4 modules @ 3200MT/s installed in our system).

AMD makes decent APU units with great integrated graphics. The RX Vega 8 looks unexciting on paper, yet we received unexpected benchmarks.

Nvidia T600 Quadro

The Nvidia T600 GPU is a fairly modern dedicated graphics card that was launched in April 2021 based on the Turing architecture (TU117 chip). It is equipped with 640 CUDA units and a 128 Bit memory bus for 4GB of GDDR6 dedicated graphics memory. The GPU is similar to NVIDIA 1650 with some of its CUDA cores disabled (640 vs. 896 CUs), while the price of a T600 Quadro is significantly less than the price of the NVIDIA 1650. Our sample is clocked at 1335 MHz. Spec sheet (PDF).

This fairly modern video card is based on a stripped-down, low-end video card and architecture from three years back. You cannot go any lower with any modern video card that can be bought new (unless you consider a truly ancient architecture such as the NVIDIA 1030 or 1050). The Quadro T600 can be bought for around 150€, and its performance sounds tempting, at least on paper.

Nvidia GeForce GTX 1650

The Nvidia GeForce GTX 1650 is a dedicated graphics card based on the Turing architecture (TU117 chip) that was launched in April 2019. The card is equipped with 4GB of GDDR5 dedicated graphics memory connected with a 128 Bit memory bus. Our sample is clocked at 1830 MHz.

The NVIDIA 1650 is a low-end video card released three years back. At the time of release, the card was priced around 200€; the lowest price today floats around 265€. We’ll use this card as a point of reference.

Test bench

The tests have been performed on computers with the following configurations.

1. Intel(R) Core(TM) i7-9700K CPU @ 3.60GHz; 4x16GB DDR4 @3000 MT/s
2. Intel(R) Core(TM) i7-9700K CPU @ 3.60GHz, Intel(R) UHD Graphics 630 (24 CU @ 1200 MHz, 1638 MB)
3. AMD Ryzen 7 5700G with Radeon Graphics, AMD Radeon(TM) Graphics (8 CU @ 2000 MHz, 3072 MB); 2x8GB DDR4 @3200 MT/s
4. Intel(R) Core(TM) i7-4770S CPU @ 3.10GHz , NVIDIA T600 (640 SP @ 1335 MHz, 4095 MB)
5. Intel(R) Core(TM) i7-9700K CPU @ 3.60GHz, NVIDIA GeForce GTX 1650 (896 SP @ 1830 MHz, 4095 MB)

Benchmarks

Using Elcomsoft Distributed Password Recovery, we ran several benchmarks and received the following results (values in passwords per second).

Relative performance was calculated based on the performance of the Intel Core i7-9700K CPU (with no GPU acceleration). The exception is the AMD RX Vega 8, which is built into the AMD Ryzen 7 5700G. For this GPU, we took two different points of reference, one being the CPU cores of the Intel Core i7-9700K, and the other one (marked in red) the CPU cores of the AMD Ryzen 7 5700G.

* We compared the performance of the AMD RX Vega 8 with the performance of CPU cores of the AMD Ryzen 7 5700G.

The CPU-only test returns the expected low numbers on the Intel Core i7-9700K. When using this processor’s integrated GPU, most numbers were higher except one: the ZIP (AES-256) benchmark speeds were slower than the CPU alone. This has nothing to do with ZIP or AES-256 but the recent optimization of CPU-only code for ZIP encryption in EDPR.

AMD Ryzen 7 5700G shows respectable results with its integrated RX Vega 8 GPU. The built-in graphic cards delivers a 6.6 to 25 times performance boost compared to the Intel Core i7-9700K CPU. This is what GPU acceleration is all about: a significant performance boost at a fraction of TDP. We were surprised to see how much faster the AMD APU was in our CPU tests compared to the Intel Core i7-9700K.

The NVIDIA T600 is 8.7 to 32 times faster than the Intel Core i7-9700K, while the older NVIDIA 1650 is 15 to 60 times faster than the CPU.

Price/performance ratio

Calculating the price/performance ratio was difficult, especially for the built-in GPUs. The “performance” part is based on the SHA-256 benchmark, which is about the most optimized algorithm for every platform. To calculate the price, we took the lowest available cost of a dedicated GPU (German marketplace) and added 300€ as a cost of a Core i7 equivalent CPU to calculate the “Complete system price”. While not perfect, this method allowed us to do a more-or-less fair price/performance comparison.

Complete system price = cost of dedicated GPU + 300€ (cost of a Core i7 equivalent CPU).

Price/performance is calculated as SHA-256 performance / complete system price

Normalized price/performance assumes the p/p of a CPU-only attack as a “1”

Looking at the numbers from the benchmarks above and this table, we made several conclusions.

1. CPU-only attacks don’t make sense at all.
2. Intel UHD graphics built into Intel’s desktop CPUs does not make much sense either. It is only worth enabling if there is no dedicated GPU installed, in which case it may or may not increase the performance (depending on the format).
3. The AMD Ryzen 7 5700G offers great price/performance ratio (arguably the best from the sampled hardware), but its absolute performance is lower compared to a 3 year old entry-level dedicated GPUs such as NVIDIA 1650.
4. Among the cheap graphic cards, the NVIDIA T600 Quadro does not look spectacular. Its 3 year old counterpart, the NVIDIA GTX 1650, delivers nearly double the performance at less than double the price. Considering the cost of the entire system, the T600 does not make much sense (unless purchased in bulk for way less than the 150€ as sampled).
5. The NVIDIA 1650 is the absolute performance champion among the tested units, while offering good price/performance ratio. Paired with an older/inexpensive CPU, these cards can deliver an even better price/performance ratio.