GPU-Accelerated Decryption Engine
Benchmark Study

This white paper presents benchmark findings from BitMindz Forensic Solutions' ongoing research into hardware-accelerated password recovery, with a primary focus on ZIP and 7-Zip archives encrypted using AES-256. As digital forensic investigations increasingly encounter password-protected evidence containers, understanding the practical throughput ceiling of contemporary hardware is critical for case planning, resource allocation, and toolchain selection.

The BitMindz Decryption Engines are purpose-built workstations and server nodes designed to maximize passwords-per-second (p/sec) throughput by exploiting the massively parallel architecture of modern GPUs via OpenCL. Each engine is configured to harness simultaneous CPU and GPU resources, with the GPU handling the bulk of hash computation and the CPU managing job orchestration, dictionary preprocessing, and attack sequencing.

Testing began in 2018 on a single-GPU consumer workstation and has expanded progressively to multi-GPU and multi-node configurations. The data collected across this period provides a unique longitudinal perspective on how GPU architectural improvements — from the Turing to Ada Lovelace microarchitectures — translate into measurable forensic throughput.

Research Questions

1. How does GPU-accelerated password recovery throughput scale across hardware generations for AES-256 ZIP archives?
2. What is the performance contribution ratio between CPU and GPU components in a hybrid attack configuration?
3. How does thermal loading affect sustained throughput in long-duration recovery operations?
4. What are the diminishing returns of adding additional GPU nodes in a distributed recovery cluster?
5. How do attack strategies (brute-force vs. dictionary/join attacks) compare in time-to-solution for common password patterns?

Benchmarks were captured across six distinct system configurations spanning consumer-grade workstations to enterprise multi-GPU servers. The following hardware specifications were extracted directly from the Passware Kit Forensic resource monitoring interface as captured in the benchmark screenshots.

The following table summarizes all benchmark sessions captured, ordered by total system throughput. All measurements are derived directly from the Passware Kit Forensic resource monitoring panels captured during live attack sessions targeting AES-256 encrypted ZIP archives.

Password Analysis Counts Captured During Benchmark Sessions

The primary encryption target in all benchmark sessions was AES-256-CBC as implemented within the ZIP and 7-Zip archive format specifications. Understanding the cryptographic underpinning is essential to contextualizing the throughput figures, as the cost-per-hash function directly determines how quickly candidate passwords can be tested.

Why GPU Acceleration Dominates

Modern GPUs contain thousands of shader cores designed for highly parallelizable mathematical operations. PBKDF2-SHA1 — the key derivation function in AES-encrypted ZIP archives — can be decomposed into thousands of independent computation streams, each testing a different password candidate. The RTX 3090, with 10,496 CUDA cores, can sustain nearly 8 million such computations per second. The RTX 6000 Ada, with 18,176 CUDA cores, achieves even higher throughput while operating at lower thermal density due to architectural efficiency improvements in Ada Lovelace.

By contrast, a CPU — even a 32-core Threadripper — processes password candidates sequentially across fewer, more complex cores optimized for latency rather than throughput. The resulting CPU contribution is consistently below 2% of total throughput across all configurations tested.

function testCandidate(password, salt, verifier) {
  // 1,000 iterations of HMAC-SHA1 key derivation
  dk = PBKDF2(HMAC-SHA1, password, salt, iterations=1000, dkLen=32);
  // Verify derived key against stored password verifier
  return verify(dk, verifier);
}

// GPU executes ~8,000,000+ instances of testCandidate() per second (RTX 3090)
// GPU executes ~13,000,000+ instances per second (RTX 6000 Ada)
// 17 GPUs in cluster: ~193,000,000+ instances per second

Attack Strategies Employed

All benchmark data was captured using Passware Kit Forensic, a commercially licensed password recovery platform widely used in law enforcement and digital forensics contexts. The software's resources panel provides real-time per-device throughput measurements, allowing precise attribution of performance contributions to individual CPU and GPU components.

Test File Preparation

Benchmark archive files were created as standard ZIP files using AES-256 encryption, consistent with the output produced by both WinZip and 7-Zip when configured for AES-256 mode. Files observed across sessions include Encryption_Test.zip, Encryption_Test_3.zip, Encryption_4.zip, and Passware_Test_Win_Zip.zip. Each archive was encrypted with a known password to validate recovery success and confirm algorithmic correctness of the attack queue.

Performance Measurement Protocol

Screenshots were captured at representative intervals during active attack sessions, with the software displaying real-time and average throughput figures per device. For the purposes of this study, "peak p/sec" refers to the highest instantaneous throughput observed in the system-level aggregate reading during that session, while "average p/sec" refers to the time-weighted mean reported by the software.

Distributed Agent Configuration

Multi-node configurations (Configs D/E and F) used Passware Kit Forensic's agent protocol over a LAN connection. Remote agent nodes are identified by IP address in the resource panel. The primary workstation coordinates attack distribution and aggregates results; remote nodes execute hash computations and report back at regular intervals. Network overhead was observed to be negligible (<1% throughput variation attributable to network latency) on a gigabit LAN.

Eight years of continuous benchmarking by BitMindz Forensic Solutions has yielded a clear and quantified picture of how GPU-accelerated password recovery performance has evolved — and continues to evolve — across hardware generations.

Key Findings

Practical Implications for Digital Forensics

For forensic practitioners, these findings have direct operational implications. A single-GPU workstation with an RTX 3090 or equivalent can recover typical short (≤8 character) passwords from AES-256 ZIP archives within minutes to hours using combined dictionary and brute-force strategies. Multi-GPU configurations reduce this window proportionally. For large-scale or time-sensitive investigations, a distributed BitMindz Decryption Engine cluster eliminates most practical password-length barriers below 10 characters.

The data further reinforces that password complexity — not just length — remains the most effective deterrent. Mixed-case alphanumeric passwords with special characters create keyspaces that remain computationally intractable even at 193M p/sec, making strong password hygiene the most reliable defense against GPU-accelerated recovery attacks.

Future Research Directions

Planned expansions to this benchmark study include: (1) Performance characterization against 7-Zip native encryption (AES-256 with SHA-256 key derivation), which is expected to show significantly lower throughput due to higher iteration count; (2) Integration of next-generation Blackwell-architecture GPUs; (3) Performance profiling of rule-based mutation attacks for enhanced coverage of real-world password patterns; and (4) Cross-platform comparison of CUDA vs. OpenCL kernel performance on identical hardware.