john-users - Re: FileVault?

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Mon, 2 Jun 2008 17:20:22 -0400
From: "Junty Mesmon" <jmesmon@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: FileVault?

> Has anyone ever used JTR for FileVault? I've not had any luck finding any
> info on it.

Assuming you have access to the hashed login of the particular user
who's FileVault encrypted files you wish to decrypt,
JtR can crack said hash, and the following pdf has information about
the encryption mechanism and key generation (based on password).

http://crypto.nsa.org/vilefault/23C3-VileFault.pdf

On page 9:
>>Login password used to derive key for
>>unwrapping
>>. PBKDF2 (PKCS#5 v2.0), 1000 iterations

---
and after writing that, it seems the person responsible for the pdf
also wrote software to crack it anyhow.
http://crypto.nsa.org/vilefault/
the tar.gz link on that site.

-- 
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.