[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 5 Dec 2011 18:19:26 -0600
From: "JimF" <jfoug@....net>
To: <john-users@...ts.openwall.com>
Subject: Re: cracking RADIUS shared secrets with john the ripper
Using set_salt() vs salt() to do the HEX->binary conversion causes this to be done each time, for each password. If we can do this in salt, it is only done one time, at startup.
However, the caveat here is, 'can' these salts contain NULL bytes? If so, then we either have to do the work like you have it done, or have the salt returned be like a Pascal string (length prepended to the string of bytes). Other than this 'possible' change, I think this addition to dynamic is good.
I do believe we will need to make changes in the 'length' computation parts (in valid I believe), which causes hashes to be set as invalid if lengths of things are too much (such as salt length). This computation should be done POST hex2bin, so that these salts would only be properly counted as 16 bytes, even though they take up 36 bytes in 'string' format.
once this is added, we could add $HEX$hex_salt to any salted format, and it should be 'happy' with it.
Jim.
From: "Didier Arenzana" <darenzana@...il.com>
> Hi,
> I have added a patch, and a zip file containing a perl script to the
> wiki, with a page with brief instructions on how to use both of them
> to crack RADIUS shared secrets :
>
> http://openwall.info/wiki/john/Using-john-to-crack-RADIUS-shared-secrets
>
> I'd be glad to have comments on this.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
