Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 5 Apr 2012 10:37:24 -0500
From: "jfoug" <jfoug@....net>
To: <john-dev@...ts.openwall.com>
Subject: RE: ssh format testing

>For testing ssh format, I generated 3100+ private keys using
>password.lst for input passphrases. This testing revealed a bug in
>ssh2john program (missing call to BIO_free function). An OMP build of
>JtR could successfully crack all the private keys (no bugs!). I have
>uploaded the key collection to the wiki.

Very nice.

>We should do this exercise for the all (?) formats for bug-hunting and
>verifying correctness.

We should see if we can incorporate this into the test suite, and if we
generate this data for other formats not yet in the ts, then do the proper
generation, and after the fact, get them into the ts.

NOTE, the TS as designed, would not be able to test the xxx2john
preprocessing type programs for bugs.  It's good you found this bug, but
this has not been designed into the TS.

Jim.

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ