Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 10 Aug 2011 11:38:17 +0200
From: magnum <rawsmooth@...dband.net>
To: john-dev@...ts.openwall.com
Subject: Re: "valid character" class

On 2011-08-10 05:27, Solar Designer wrote:
> My concern, though, is that I am unsure what use cases we will have for
> either of these new classes.  Do you have specific rules you'd like to
> add, but can't do it yet?  Are you aware of specific real-world
> passwords that this would crack?  So far, all this encodings stuff feels
> a bit theoretical.  I guess it will be relevant in the future, but is it
> already relevant?  Perhaps it is, but we're yet to see it actually being
> used to crack passwords...

I'm not sure about the new classes, time will tell. If they prove 
worthless we can ditch them. The rationale was that adding them was dead 
easy (the only metadata we haven't yet found a way to get "for free" for 
any codepage is the distinction of vowels and consonants) and there's no 
point in including impossible combinations when attacking slow hashes in 
this or that codepage.

About encoding in general: I know it is already relevant, though 
naturally much less so for Americans like Korelogic than for their 
colleauges in Greece, France or Slovenia. I only have one single concern 
and that is performance - especially if hitting performance when *not* 
using the new options. We try to design so it won't happen, and if it 
does anyway and we fail to mitigate it we will reconsider or redesign.

magnum

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ