john-users - RE: encryption strength vs. the time it takes to find the same password with different key sizes

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Thu, 31 Aug 2006 13:58:17 -0700
From: "Bolan, Scott" <Scott.Bolan@...perdine.edu>
To: <john-users@...ts.openwall.com>
Subject: RE: encryption strength vs. the time it takes to find the same password with different key sizes

John wrote
-------------------------------------------------
I am trying to better understand this, so please bare with me. Lets say
I
have two hashes I want to crack. Each hash uses the same password.
If
one encryption is with 32 bit. and the other is 64 bit.  would cracking
the
64 bit encryption actually take longer? Even though they both use the
same
length password? For example: I got thinking that if you used an
lowercase
alpha only password, that is 6 chars long.. so 26^6 possible combos to
break
it.... wouldn't it be the same for each encryption strength?
-------------------------------------------------

This is not quit what you were asking but it might be of interest.

It is my understanding that *all* 32 bit hashes can be cracked.  Here is
the reasoning.

- Since a hash has a finite length, multiple passwords will generate the
same hash.  (the pigeon hole principle: there are more possible
passwords then there are hashes)

- a 32 bit key has 2^32 possible hashes (4,294,967,296).  A big number
but on a reasonable computer this is 1 - 4 weeks of work.

So instead of a 'naive' brute for attack, (a, b, c, ... , aa, ab, ac,
...), you can try all possible hashes.  This will give you *a* correct
password although it probably won't give the *the* correct password.
You just need to find *a* password that hashes to the correct value
(there are many).

I suspect that the password you found would work for the 32 bit
encryption but not for the 64 bit encryption.  This is because you just
found one of the passwords that worked for the 32 bit encryption and not
the 'actual' password.

Feel free to correct me if you think I am off my rocker.

-- 
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.