Date: Wed, 18 Apr 2012 16:22:36 +0200 From: Frank Dittrich <frank_dittrich@...mail.com> To: john-dev@...ts.openwall.com Subject: Re: Weekly report 1 On 04/18/2012 02:38 PM, myrice wrote: > Yes, I just noticed this. I took a look at crack.c. > In crk_password_loop(), we invoke crypt_all for crypt a bunch of passwords. > And next we invoke cmp_all for all hashes with same salt. But I still not > sure about how to use get_hash*(). Whether cmp_all or one of the get_hash* functions (and which one of those) gets called depends on the number of different hashes per salt you have. If there is just one hash per salt or just a few hashes per salt, cmp_all will be called, otherwise one of the get_hash* functions (which one again depends on the number of hashes per salt). For decent hash algorithms and correct implementations, you'll usually have just one hash per salt, since there are so many possible salts, and the salt should be generated randomly. There are, however, poorly designed hash algorithms which allow only a very limited number of different salts. And there are also broken implementations which do not pick a truly random salt when computing a hash for a changed password. That's why, you cannot rely on cmp_all being called, even if in most cases (decent hash algorithm and correct implementation) you'll just find one hash per salt in a file of password hashes. BTW: Somehow you always manage to insert your replies to quoted text in a way that looks like the first line of your reply is part of the quoted text. This is somewhat confusing. Could you try to put an empty line between text you quote and your reply? This should it make easier to read your mails and recognise which part is quoted text, and which part is your reply. Thanks, Frank
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.