Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 2 Jul 2012 12:41:42 -0500
From: "jfoug" <jfoug@....net>
To: <john-dev@...ts.openwall.com>
Subject: RE: I think I got it (was: For some dynamic formats on linux-x86-mmx build cracking depends on password candidate sequence)

>From: Frank Dittrich [mailto:frank_dittrich@...mail.com]
>
>I think I know what happens, and IMO the sse2i format just passes the
>test suite by accident.
>
>In the pw.dic, we have passwords that are 110 characters long in certain
>positions.
>
>$ ./john --list=format-all-details |grep -B 15 -A 5 dynamic_2:
>
>Format label                    	dynamic
>Max. password length in bytes   	82

I will have to check for sure, but DUE to this being generic, I did make it so it would work with longer PW's.   The format itself, should set the max password length IT wants.  Each sub format will or should know how many bytes are valid.  SSE builds vs non-SSE builds do (or can) change this.

It appears that this format (dyna 2) is busted, as likely are others.  I will correct this.  Dyna2 in SSE (mmx) builds should truncate any password longer than 55 bytes to only be 55 bytes long.


>Min. keys per crypt             	1
>Max. keys per crypt             	128
>Flags
> Case sensitive                 	yes
> Supports 8-bit characters      	yes
> Converts 8859-1 to UTF-16/UCS-2	no
> Honours --encoding=NAME        	no
> False positives possible       	no
> Uses a bitslice implementation 	no
> The split() method unifies case	no
>Number of test cases for --test 	24
>Algorithm name                  	128/128 SSE2 intrinsics 8x4x4
>Format name                     	dynamic_2: md5(md5($p)) (e107)
>Benchmark comment
>Benchmark length                	-1
>Binary size                     	16
>Salt size                       	0
>

I will spend some time auditing the format, (all sub formats, for all build types), and make appropriate changes to dyanamic_preloads.c and dynamic.conf files, so that they are setup properly.   NOTE, in dyna.conf, the task is MUCH harder, since it does not know how JtR was built.  Within dynamic_preloads.c, it does know how JtR is being compiled, so #defines can give different settings for SSE or for non-SSE builds.

Jim.

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ