[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 27 Jun 2012 15:42:47 -0500
From: "jfoug" <jfoug@....net>
To: <john-dev@...ts.openwall.com>
Subject: RE: incomplete valid() tests for many jumbo formats
There are several things in play here. Yes there are MANY valid's which
really need to be written. Many are simply still just skeletons.
1. Try to catch garbage, bogus hashes. Certain formats may be 'hard' to
test, since there is a lot of variability, but many are simply testing for a
few strings, and then making sure the hash is base-16, or base-64 and right
length.
2. If there are multiple versions, use prepare() or split() to unify them
(if they 'can' be). Prepare() has access to all GECOS.
3. Try not to slow down load time 'too' much.
4. Avoid allocations if possible, use local arrays.
#3 is usually ONLY a problem for the fast formats, where there may be LARGE
collections of hashes. For most of the formats listed (at the current
time), it will probably be unlikely that more than a couple thousand (or
couple 10's of thousands) of hashes will be available to process.
>-----Original Message-----
>From: magnum [mailto:john.magnum@...hmail.com]
>Sent: Wednesday, June 27, 2012 3:30 PM
>To: john-dev@...ts.openwall.com
>Subject: Re: [john-dev] incomplete valid() tests for many jumbo formats
>
>On 2012-06-27 22:09, Frank Dittrich wrote:
>> Several formats use very limited tests in valid().
>>
>> Best case scenario is that the format tries to crack hashes which are
>> invalid, worst case scenario is that various errors can occur if
>> someone passes data which will overflow buffers.
>> The sooner we fix this, the sooner other contributors creating patches
>> for new formats or for GPU implementations of existing formats will
>> find better examples of how to implement valid().
>>
>> Examples:
>> cuda_pwsafe_fmt.c:53:static int valid(char *ciphertext, struct
>> fmt_main
>> *pFmt)
>> cuda_pwsafe_fmt.c-54-{
>> cuda_pwsafe_fmt.c-55- return !strncmp(ciphertext, "$pwsafe$",
>8);
>> cuda_pwsafe_fmt.c-56-}
>...
>
>Yes, this is a problem, and sometimes it's worse than the above (where
>input files would be generated by pwsafe2john so are not very likely to
>be malformed). If you feel like writing patches, just check out bleeding
>and hit it! That won't disturb Jumbo-6. I committed the -Wdeclaration-
>after-statement there.
>
>magnum
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
