19 out of 24 words of BIP39 passphrase (brute-force last 5?) I have managed to lose 5 words of my 24 word Ledger Nano S recovery phrase. I have words 1-19 but I am missing words 20-24.
I have significant holdings on the wallet so would very much like to recover it if possible.
The passphrase is a BIP39 mnemonic (see https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki).
I have the bitcoin and ethereum public addresses for this mnemonic. I am wondering if it's feasible to brute force the passphrase.

Each word is 11 bits (2^11 = 2048 possible words).
The last (24th) word of the passphrase is of the following form [3 random bits][8 bit checksum].
Therefore I only have to check 2^(55 - 8) = 2^47 = 1.4x10^14 combinations.
I would have to compute SHA-512-HMAC with an iteration count of 2048.
As far as I understand, that means I'd have to compute 1.4*10^14 * 2048 = 2.87*10^17 hashes in total.

Is there any hardware out there designed for this? I am aware of ASICs that compute sha-256 hashes but not sha-512 hashes.
Perhaps I could tweak one to work with sha-512 since they are very similar.

Assuming a fairly typical ASIC hashrate of 1TH/s (10^12 hashes per second), I could exhaust the search space in 2.87*10^5 = 287000 seconds = 3.3 days. I'd probably get there sooner, of course (expected 1.65 days). Time is not something I am worried about. Even if I have to wait months, I don't mind - so if I can get 10GH/s at a reasonable price, that would be great.

I would really appreciate any help/information you could provide to help me out and make sure I haven't missed anything.
I could also use GPUs for this (I calculate I can run them at roughly $1/10TH - so it would cost me $28.7k to exhaust the search space, which I will do if there are no cheaper options).

Many thanks,
James
You have three options here:


Using a GPU implementation of the Gurnec´s Seed Recovery script
Use Hashcat / JTR, where PBKDF2-HMAC-SHA512  is already implemented.
Use brainflayer, similar to Gurnecs software, no multithread, no GPU.


Gurnec´s script runs at aproximately 40kh/s under my i7-8700k without OC. So if you only had lost the last 4 words of your seed, it will be 2^36 hashes.

2^36 h / 40.000 h/s = ~ 20 days

So it will take roughtly 3 weeks to test every combination.

But to crack the last 5 words of your seed it would take 2048 * 20 days.

On the other side according to the benchmarks PBKDF2-HMAC-SHA512 hashes at a 4.800 kh/s under a usual 8 x 1080´s rig so it should be possible to recover in several days the 5 missing words.

tldr; Implement GPU in btcrecover or brainflayer or understand how to make it work under Hashcat. Up to 3 words + checksum word doable in CPU, more need GPU.