Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 13 Oct 2005 04:49:29 +0400
From: Solar Designer <>
Subject: Re: restricting john to eight character passwords

On Wed, Oct 12, 2005 at 12:44:59PM -0400, joe haldon wrote:
> Assuming the PDC restricts users from entering passwords less than eight
> characters, how does one limit the search to only eight chars? And not 7 and
> not 9 chars? Just 8.

I am assuming that you're speaking of Windows passwords.  If so, out of
the box, John supports cracking only the weaker LM hashes, -- that most
Windows systems still use.  Those hashes have a nice property that
allows for the first 7 characters of any password to be cracked
independently and simultaneously with the remaining 7 characters (the
maximum length of a password hashed in this way is 14 characters).

John the Ripper takes advantage of this property, for a huge speedup.
With LM hashes, it will only be trying strings of up to 7 characters
against LM hash halves.

Thus, even with the "8+ restriction" you mention, it is optimal for John
to be trying those shorter strings.  It simply has no need to try
anything longer.

> I'm assuming it's in the RULES file but not sure which rule to modify.

doc/RULES is a documentation file.  The actual wordlist rules that John
uses are stored in john.conf (or john.ini).  But they're not relevant to
this and, more importantly, you do not need to apply any change as I've
explained above.

Alexander Peslyak <solar at>
GPG key ID: B35D3598  fp: 6429 0D7E F130 C13E C929  6447 73C3 A290 B35D 3598 - bringing security into open computing environments

Was I helpful?  Please give your feedback here:

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ