Date: Thu, 13 Oct 2005 13:28:46 -0400
From: joe haldon <kbcboy@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: restricting john to eight character passwords

You're right windows did make it easier to crack passwords like that. I
don't know what I was thinking.
On a solaris box recently the /etc/default/passwd file had a setting
PASSLENGTH option to 8. Standard DES. Still it took a long time and was
wondering if it would speed things up significantly to restrict the search
to 8. Does that make better sense? Maybe the other option is to only have
eight char words in the dictionary file?
Anyway thanks for creating an awesome program.

On 10/12/05, Solar Designer <solar@...nwall.com> wrote:
>
> On Wed, Oct 12, 2005 at 12:44:59PM -0400, joe haldon wrote:
> > Assuming the PDC restricts users from entering passwords less than eight
> > characters, how does one limit the search to only eight chars? And not 7
> and
> > not 9 chars? Just 8.
>
> I am assuming that you're speaking of Windows passwords. If so, out of
> the box, John supports cracking only the weaker LM hashes, -- that most
> Windows systems still use. Those hashes have a nice property that
> allows for the first 7 characters of any password to be cracked
> independently and simultaneously with the remaining 7 characters (the
> maximum length of a password hashed in this way is 14 characters).
>
> John the Ripper takes advantage of this property, for a huge speedup.
> With LM hashes, it will only be trying strings of up to 7 characters
> against LM hash halves.
>
> Thus, even with the "8+ restriction" you mention, it is optimal for John
> to be trying those shorter strings. It simply has no need to try
> anything longer.
>
>

Hosted by DataForce ISP - Powered by Openwall GNU/*/Linux