Date: Thu, 29 Mar 2012 04:38:57 +0400 From: Solar Designer <solar@...nwall.com> To: john-dev@...ts.openwall.com Subject: Re: GSoC non-hash office documents Hi Mike, On Wed, Mar 28, 2012 at 11:23:48AM -0600, Mike Wing wrote: > I'm rather interested in working on some of the non-hashes for GSoC. > Specifically > the Office ones that popped up recently. Just doing a rudimentary search, > the MS office format (up to 2003) using XOR and RC4 appears to be fairly > compromised and exploitable as outlined in this paper > http://eprint.iacr.org/2005/007.pdf. And this has been further developed by > a french researcher (here: > http://www.esiea-recherche.eu/data/filiol_pacsec.pdf). I would like to work > on bringing these features to JtR. How would these fit in with JtR, in terms of reuse of existing code, user interface, documentation, etc? I think that they won't. So far, JtR has been primarily a tool to generate candidate passwords (including in some smart ways) and to test those against various thing (including in efficient ways). So that's what within scope for Office documents as well. Other kinds of attacks on Office documents (or whatever) are currently out of scope. I imagine that at some point in distant future we might choose to bundle all sorts of things with/in JtR, but there's little technical reason to do that. It would be like moving from developing a consistent program to maintaining a distribution of various tools grouped only by purpose. Maybe it'd make sense for "marketing" eventually - making JtR more of a Swiss army knife than it currently is - but for now we have plenty of tasks more closely related to JtR's current code base and functionality, so we'd rather focus on further advances in that area. I also touched on this general topic here: http://www.openwall.com/lists/john-dev/2012/03/24/2 As you can see, Dhiru has already started work on having JtR test candidate passwords against Office documents - a task that is within scope for JtR development currently. Please feel free to compete with him (work on the same thing in parallel and try to make your implementation better in whatever ways - source code quality, speed, anything). Alternatively, please feel free to coordinate with him, so that the two of you work on the task together. Finally, please feel free to pick another sub-task instead - e.g., there's demand to be able to crack Mac OS X keychains and FileVault with JtR, but no code for that has been contributed so far and I'm not aware of anyone seriously working on it at the moment. (Other tools exist for the purpose, though, and code reuse from them is possible if licenses permit.) Thanks, Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.