Paper 2026/1499

BF²: A Bloom-Filtered Brute-Force Framework for Multi-Target Password Recovery

Abstract

Password-based authentication remains widespread, and large-scale sets of leaked hashes enable practical offline brute-force attacks. Multi-target attacks, which check candidates against large sets of hashes simultaneously, are particularly effective. Understanding the capabilities of low-cost platforms for such attacks is important to assess real-world password security risks. Therefore, we present BF², a modular and scalable FPGA–CPU framework that accelerates multi-target password recovery. BF² combines a password-candidate generator, a fully-pipelined NT hash core, a Bloom filter stage to filter non-matching candidates, and a multi-threaded host-side component that performs exact membership check using a perfect hash function. We implement BF² on the low-cost, \$199 NiteFury II board. With 16 parallel pipelines running at a 100 MHz clock frequency, our FPGA implementation generates $1.6\times10^9$ hashes/s. In our experiments, BF² demonstrates up to $7.5\times$ higher throughput than John the Ripper, and reduces power consumption by as much as $90\%$ compared to Hashcat on an RTX 5000.