Date: Sun, 15 Apr 2012 07:39:24 +0200 From: Frank Dittrich <frank_dittrich@...mail.com> To: john-dev@...ts.openwall.com CC: john-users@...ts.openwall.com Subject: maximum password length (was: fast hashes on GPU) Hi Alexander, I'll CC john-users, because at least some parts of my mail are probably relevant on that list too. On 04/15/2012 02:59 AM, Solar Designer wrote: > Lion's actual maximum password length is probably different - can be > lower or higher than 107. It might even vary by the method used to set > the password (such as GUI vs. CLI). May be someone on john-dev or john-users could check this out. The real maximum password length should be documented somewhere. Either as a comment in the code, or on a wiki page, or both. We should also collect this information for any other hash type, so that we at least know the maximum password length when the password length supported by john's (highly optimized for speed) implementation is lower. In certain circumstances it might be needed to implement a less optimal algorithm (may be q&d and ad hoc), to try a few passwords that are longer that the limited length of the tuned algorithm. OTOH, if we really know the actual maximum password length for a format, we probably shouldn't support trying longer password candidates. If there cannot be such passwords in the wild, allowing to test such invalid passwords would just waste time. If we reduce the supported maximum password length to the actual length, we could document the maximum password length which would not impact performance somewhere in the code, e.g. a comment close to the maximum password length definition. Just in case that in future the maximum password length actually used somewhere in the wild increases, we could easily adjust that length in the code. (But after reducing the maximum supported password length, bit rot or further code optimization might make switching back to the older maximum password length more difficult.) Frank
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.