Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 10 Aug 2011 00:58:15 +0200
From: magnum <rawsmooth@...dband.net>
To: john-dev@...ts.openwall.com
Subject: DES vs 8-bit

This is quoted from last years contest writeup (by Solar):

"Another issue was with DES-based crypt hashes, which process only 7 
bits of each character (ignoring the 8th bit). This means that for a 
given valid passwords, many variations of it are possible (with the 8th 
bit of every character possibly flipped), most of which will not match 
those on Kore's list of correct passwords, yet all of them are correct."


Wouldn't it be more logical if JtR itself would strip the 8th bit before 
reporting the cracked password? I think this is comparable to LM, where 
an input of "foo" will be cracked and reported as "FOO"?

magnum

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ