Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 11 Aug 2012 00:01:28 +0200
From: magnum <john.magnum@...hmail.com>
To: john-dev@...ts.openwall.com
Subject: Re: mscash2 / hmac-md5 ambiguity

On 2012-08-10 17:09, Alexander Cherepanov wrote:
> On 09.08.2012 03:30, magnum wrote:
>> On 2012-08-08 23:27, Alexander Cherepanov wrote:
>>> On 2012-07-27 09:58, Frank Dittrich wrote:
>>>> On 07/27/2012 06:58 AM, Frank Dittrich wrote:
>>>>> On 07/27/2012 12:57 AM, Alexander Cherepanov wrote:
>>>>>> One solution is to add to hmac-md5 hashes some prefix like 
>>>>>> $HMAC-MD5$ or {HMAC-MD5}. BTW why there is none now?
>>>>> 
>>>>> Because for hmac-md5 *any* input is valid, you don't know if
>>>>> a hash is prefixed, of if "{HMAC-MD5}" just happens to be the
>>>>> begin of an unprefixed string, so you'd have to convert it
>>>>> to "{HMAC-MD5}{HMAC-MD5}"
>>> 
>>> If we always require some prefix in this format then there is no 
>>> problem. When the prefix is present then we accept this hash and
>>> strip the prefix before actual processing. When there are no such
>>> prefix we simply reject this hash (for this format).
>> 
>> I believe we currently never really require format tags.
> 
> What do you mean? Prefix '$1$' is required, '$PHPS$' is required, 
> '{SHA}' is required, '{SSHA}' is required.

I trust you are right. I did not know that. I thought we could supply
bare hashes even to MD5.

>> If you put a dynamic_0 tag on a 32-character hex string, it will be
>> recognized as a raw-md5 with no --format given. If you do not use
>> the tag, you can load the bare hash using --format=raw-md5. I
>> really like it this way so I think I disagree with the above idea.
> 
> The difference here is that you don't have a string for hmac-md5, you
> have two strings. So you need to combine them into one string. At
> this step you decide inn which order to concatenate strings and which
> separator to use. Adding some prefix doesn't change much.

I have no idea why this bothers you this much, but I do not object. Feel
free to submit a patch that fixes this issue, and I will apply it!

magnum

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ