[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 13 Aug 2015 14:32:05 +0200
From: Frank Dittrich <frank.dittrich@...lbox.org>
To: john-dev@...ts.openwall.com
Subject: Re: Lei's weekly report #15
On 08/13/2015 02:14 PM, Lei Zhang wrote:
> On Aug 13, 2015, at 7:24 PM, Frank Dittrich <frank.dittrich@...lbox.org> wrote:
>>
>> On 08/13/2015 12:17 PM, Lei Zhang wrote:
>>> For example, '€€€€€€€' cannot be cracked, while '€€€€€€' (one less char) can be cracked.
>>
>> In utf-8, € needs 3 bytes. So, these are 21 bytes which will get
>> truncated to 19.
>
> I'm a bit confused. So this PLAINTEXT_LENGTH limit is byte-wise instead of character-wise?
Unfortunately, yes, this functionality has been designed more than 20
years ago, when probably nobody outside China, Japan and a few other
countries used multi-byte code pages.
.
For performance reasons, many format implementations pick a length which
allows to hash just one block if the MD5/SHA1/... hash function.
The max length issue is complex:
First, we do have the max. password length limits of our implementations
- usually in bytes, but it could be in characters as well (for formats
that internally use a single-byte code page and map the non-ascii to
ascii characters (DES converting 8bit into 7bit characters, sapB
"mapping" non-ascii characters to '^', etc.).
Then we have the max. password length supported by the application where
the user enters his password.
Old SAP systems have a limit of 8 characters (not bytes), new systems
have a limit of 40 characters (not bytes), unless you use some Chinese
characters which don't fit into utf-16, then the length is limited to 20
of these characters.
And finally, we would have to distinguish between systems where the user
is aware of the limitation (i.e., because the input mask doesn't allow
entering more characters and systems that silently drop any characters
that exceed the application's supported max. password length.
And you never know whether a web application has other bugs.
I once got a warning that minimum password length is 4, while my
password was much longer. I just used either '<' or '>' (don't remember
which one) as the third character.
Has I used < as the fifth character, my complex password might have been
silently converted into a rather simple one.
Frank
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
