john-users - Re: Thoughts and questions on creation of a 'generic' MD5 hash set format (to handle 'all' of them)

Openwall GNU/*/Linux 3.0 - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 29 Aug 2009 11:27:21 -0500
From: "JimF" <jfoug@....net>
To: <john-users@...ts.openwall.com>
Subject: Re: Thoughts and questions on creation of a 'generic' MD5 hash set format (to handle 'all' of them)

From: "SL" <auditor@...chat.de>
> $u is supposed to be the username, right?
> $s2 is something like a static, systemwide key (like the syskey in 
> Windows SAM).
>
> Whatever I have encountered so far is on your list already. Good Job.
>
> In handling, I see not much difference between $u and $s2 (or $k or 
> whatever). But I agree to the path of 'reserving' such expressions.

There was an eariler reply of:

>md5(md5(md5($p).$s).$s2) with $s2 being a secondary salt.

So my assumption, was that there would be a format with 2 salts in it.  And 
yes, the $u (in my 'simple' syntax), would be $user or the user ID for this 
user.    The user id I know 'can' be obtained, as it is within the database 
structures in memory when John is running (not sure if -save-memory keeps 
the user id out of memory).  I would think the second salt would have to 
somehow be 'found' within the hash's data, but I have not laid out just how 
to do that yet, as I am not sure exactly how it is being 'used' in the field 
(i.e. I have no example input data to test against).

I got about 1/2 done last night implementing the expressions, checking that 
they 'worked' (at least that the validation data ran properly).  However, 
today I have to spend most of my time on a 'honey-do' list.  Meaning the 
woman is on the rampage to get little projects finished around the house, 
lol

Jim.

-- 
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.