[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 09 Aug 2012 01:27:00 +0400
From: Alexander Cherepanov <cherepan@...me.ru>
To: john-dev@...ts.openwall.com
Subject: Re: mscash2 / hmac-md5 ambiguity
On 2012-07-27 09:58, Frank Dittrich wrote:
> On 07/27/2012 06:58 AM, Frank Dittrich wrote:
>> On 07/27/2012 12:57 AM, Alexander Cherepanov wrote:
>>> One solution is to add to hmac-md5 hashes some prefix like $HMAC-MD5$ or
>>> {HMAC-MD5}. BTW why there is none now?
>>
>> Because for hmac-md5 *any* input is valid, you don't know if a hash is
>> prefixed, of if "{HMAC-MD5}" just happens to be the begin of an
>> unprefixed string, so you'd have to convert it to "{HMAC-MD5}{HMAC-MD5}"
If we always require some prefix in this format then there is no problem. When
the prefix is present then we accept this hash and strip the prefix before
actual processing. When there are no such prefix we simply reject this hash
(for this format).
So it boils down to the question of how hmac-md5 hashes are formatted ITW.
If there is no generally accepted form then we can require anything. If there
is such a form then we don't control it and cannot require a prefix.
> What would work is if you change the sequence.
>
> Instead of
> YT1m11GDMm3oze0EdqO3FZmATSrxhquB#6c97850b296b34719b7cea5c0c751e22
> we use
> $hmac_md5$6c97850b296b34719b7cea5c0c751e22$YT1m11GDMm3oze0EdqO3FZmATSrxhquB
> or something similar.
> That way the first part is always fixed, and the variable part comes at
> the end.
BTW is there any system in using $ vs. # in hashes?
--
Alexander Cherepanov
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
