The Limits of Memory-Hardness

A Threat-Model-Conditional Cost Analysis of Password Hashing against AI-Augmented and Custom Hardware Attacks

Ans Sohail, Faizan Aslam, Abdul Muqueet Faculty of Information Technology, University of Central Punjab, Lahore 54000, Pakistan

This repository is the reproducibility artifact for the paper. It contains the full measurement pipeline, the raw result CSVs, the figure and manuscript generators, and the LaTeX (IEEE Access) source, so that every number, figure, table, and reference in the paper can be regenerated from the released data on any machine.

Summary of results

• A 2026 hardware inversion. A consumer RTX 5090 (first-party measured) reaches 219 GH/s on MD5 and the RTX 4090 a corroborated 164 GH/s, both above every datacenter accelerator we measured (L40S peak 145 GH/s; H100 126 GH/s). At an order-of-magnitude lower rental price the consumer card also wins cost-efficiency ($/hash) on all four deployed password hashes at OWASP parameters.
• A two-regime cost model. Memory-hardness multiplies attacker cost by a near-constant factor in both regimes, but the operand differs. We define a crossover budget B*(ε) and show that against low-budget targeted (PII/LLM) guessing the hash choice is immaterial, while against mass trawling it stays decisive and denies the capital-expenditure path to custom silicon.

Repository layout

experiments/     Analysis + build pipeline (calibration, cost model, figures, manuscript)
paper_tex/       IEEE Access LaTeX source, generator, and compiled main.pdf
results/         Raw measurements: attacker throughput, calibration, cost model, ROI (CSV/JSON/logs)
figures/         Generated figures (PNG) used by the manuscript
scripts_gpu/     Serverless / Modal GPU benchmark drivers (datacenter panel)
desktop_bench/   Self-contained consumer-GPU (RTX 4090/5090) benchmark harness
notebooks/       Interactive runners for the 4090 and 5090 / PassGPT experiments
data/            How to obtain the RockYou corpus (not redistributed here)

The data layer is a single source of truth: experiments/build_manuscript.py exposes load_stats() (which reads only the CSVs in results/) and the REFS list, and both the Word build and paper_tex/build_latex.py import them, so the .docx and the LaTeX cannot drift from each other or from the data.

Reproducing the paper

The manuscript and figures rebuild from the released CSVs alone (no GPU or corpus needed):

python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt

python3 experiments/make_figures.py       # regenerate figures/ from results/
cd paper_tex && ./build.sh                 # regenerate main.tex + compile main.pdf (needs pdflatex)

Re-running the underlying experiments (attacker benchmarks, calibration, compression curves) additionally requires hashcat 7.1.2, an NVIDIA GPU with the CUDA backend, and the RockYou corpus (see data/README.md). Each experiments/exp_*.py writes the CSVs in results/ that the build then consumes; the GPU panel is driven from scripts_gpu/ and the consumer-card runs from desktop_bench/.

Requirements

• Python 3.11+ with the packages in requirements.txt (numpy, pandas, matplotlib, python-docx, bcrypt, argon2-cffi).
• pdflatex for the LaTeX build (the IEEE Access .cls files are bundled in paper_tex/).
• For re-measurement only: hashcat 7.1.2, an NVIDIA GPU (CUDA), and the RockYou corpus.

Data availability

The RockYou corpus is not redistributed here (consistent with the paper's ethics statement). data/README.md documents how to obtain it and the 70/30 train/test split seed used throughout. All first-party measurements are in results/. The raw PassGPT candidate dump (~5M strings) is omitted for size; it is regenerable with experiments/exp_g2_passgpt.py, and its scored summary is in results/passgpt_meta.json and results/compression_summary.csv.

Ethics

No PII-paired breach data is used or released. Targeted-guessing success rates are taken from published aggregate CDFs, not regenerated. No live systems were attacked; all measurements are local benchmarks.

Citation

If you use this artifact, please cite the paper (see CITATION.cff, and the archived release DOI once minted).

Licensing

• Code and documentation: MIT (see LICENSE).
• paper_tex/IEEEtran.cls and paper_tex/ieeeaccess.cls are IEEE's LaTeX class files, redistributed under their original terms (LPPL / IEEE template license).
• Result CSVs and figures are released for reuse with attribution.