john-users - Re: filter performances

Openwall wordlists collection for password cracking (20+ languages)
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 16 Oct 2011 17:55:25 -0400
From: Brad Tilley <brad@...ystems.com>
To: john-users@...ts.openwall.com
Subject: Re: filter performances

On 10/16/2011 05:11 PM, Jérôme Loyet wrote:
> Hi guys,
>
> I'm new to jtr and I'm facing some performance problems (I think we
> all do somehow)
>
> I have a single traditional DES password to bruteforce. I know its
> policy:  8 characters long (or more) and it uses at least one lower
> case, one upper case, one numerical and one "other" char.
>
> If I'm bruteforcing using the mode All (with a fixed 8 chars len) I
> have 95^8 = 6634204312890625 possibilities
>
> I want to reduce the number of tries as I know the policy. I have
> 95^4*26*26*33*10 = 18170005425000 possibilities

How'd you come up with this calculation? I don't think it's accurate as 
any char position in the password could be chosen from the 95 chars.

This is correct:

char 1 (95 possibilities)
char 2 (95 possibilities)
char 3 (95 possibilities)
char 4 (95 possibilities)
char 5 (95 possibilities)
char 6 (95 possibilities)
char 7 (95 possibilities)
char 8 (95 possibilities)

This is not correct:

char 1 (95 possibilities)
char 2 (95 possibilities)
char 3 (95 possibilities)
char 4 (95 possibilities)
char 5 (26 possibilities)
char 6 (26 possibilities)
char 7 (33 possibilities)
char 8 (10 possibilities)

Also, what about the (or more) length passwords. Nine, ten, eleven or 
twelve char passwords? IMO, brute force is not the way to approach 
passwords of this lenght. Start with popular passwords, then move to 
dictionary attacks, word mangling, etc.

Hope this helps,

Brad

<snip>