BF²: A Bloom-Filtered Brute-Force Framework for Multi-Target Password Recovery
TL;DR
BF2, a modular and scalable FPGA–CPU framework that accelerates multi-target password recovery, combines a password-candidate generator, a fully-pipelined NT hash core, a Bloom filter stage to filter non-matching candidates, and a multi-threaded host-side component that performs exact membership check using a perfect hash function.
Abstract
Password-based authentication remains widespread, and large-scale sets of leaked hashes enable practical offline brute-force attacks. Multi-target attacks, which check candidates against large sets of hashes simultaneously, are particularly effective. Understanding the capabilities of low-cost platforms for such attacks is important to assess real-world password security risks. Therefore, we present BF2, a modular and scalable FPGA–CPU framework that accelerates multi-target password recovery. BF2 combines a password-candidate generator, a fully-pipelined NT hash core, a Bloom filter stage to filter non-matching candidates, and a multi-threaded host-side component that performs exact membership check using a perfect hash function. We implement BF2 on the low-cost, 199 NiteFury II board. With 16 parallel pipelines running at a 100 MHz clock frequency, our FPGA implementation generates 1.6×10^9 hashes/s. In our experiments, BF2 demonstrates up to 7.5× higher throughput than John the Ripper, and reduces power consumption by as much as 90% compared to Hashcat on an RTX 5000.