[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 21 Jun 2012 19:07:17 +0400
From: Solar Designer <solar@...nwall.com>
To: john-dev@...ts.openwall.com
Subject: Re: avoid cracked[] arrays
Dhiru -
On Thu, Jun 21, 2012 at 08:00:27PM +0530, Dhiru Kholia wrote:
> In VNC format's crypt_all, I do
>
> if(memcmp(encrypted_challenge, salt_struct->response, 8) == 0) {
Normally, this check should be in cmp_all() and cmp_one().
> DES_cbc_encrypt(&salt_struct->challenge[8],
> &encrypted_challenge[8], 8, &schedule, &ivec, DES_ENCRYPT);
> if(memcmp(encrypted_challenge, salt_struct->response, 16) == 0)
Normally, this part should be in cmp_exact().
> Doing an early memcmp saves one invocation of DES_cbc_encrypt
> function.
This is what cmp_exact() is for.
> If I remove my cracked array hack, the format will become
> slower. What should I do? Can I combine cracked array approach with
> binary interface?
> (I will store the hash in custom salt & use it in crypt_all + I will
> use binary interface at the same time).
I don't understand what you're proposing and how that would be an
improvement upon what you currently have.
As I wrote above, when you start using the cmp_*() functions as
intended, you'll avoid the extra DES invocation problem as well.
However, one drawback is that the comparisons fall outside of the
parallel region then, so performance of OpenMP builds may be slightly
worse than it currently is. This may be addressed later (1.8+) when
crypt_all() accepts a "struct salt *" and can do comparisons in this
way (against all "hashes" sharing the same salt).
Are matching challenges likely with VNC? I guess they may be if
deliberately made constant in a MITM attack, and the attack is run
against multiple VNC clients? If so, taking advantage of that would be
nice (that is, it's a reason to switch to the cmp_*() approach for now).
Please add more test vectors for VNC, both with matching and with
different challenges.
Thanks,
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
