[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 11 Aug 2012 00:01:28 +0200
From: magnum <john.magnum@...hmail.com>
To: john-dev@...ts.openwall.com
Subject: Re: mscash2 / hmac-md5 ambiguity
On 2012-08-10 17:09, Alexander Cherepanov wrote:
> On 09.08.2012 03:30, magnum wrote:
>> On 2012-08-08 23:27, Alexander Cherepanov wrote:
>>> On 2012-07-27 09:58, Frank Dittrich wrote:
>>>> On 07/27/2012 06:58 AM, Frank Dittrich wrote:
>>>>> On 07/27/2012 12:57 AM, Alexander Cherepanov wrote:
>>>>>> One solution is to add to hmac-md5 hashes some prefix like
>>>>>> $HMAC-MD5$ or {HMAC-MD5}. BTW why there is none now?
>>>>>
>>>>> Because for hmac-md5 *any* input is valid, you don't know if
>>>>> a hash is prefixed, of if "{HMAC-MD5}" just happens to be the
>>>>> begin of an unprefixed string, so you'd have to convert it
>>>>> to "{HMAC-MD5}{HMAC-MD5}"
>>>
>>> If we always require some prefix in this format then there is no
>>> problem. When the prefix is present then we accept this hash and
>>> strip the prefix before actual processing. When there are no such
>>> prefix we simply reject this hash (for this format).
>>
>> I believe we currently never really require format tags.
>
> What do you mean? Prefix '$1$' is required, '$PHPS$' is required,
> '{SHA}' is required, '{SSHA}' is required.
I trust you are right. I did not know that. I thought we could supply
bare hashes even to MD5.
>> If you put a dynamic_0 tag on a 32-character hex string, it will be
>> recognized as a raw-md5 with no --format given. If you do not use
>> the tag, you can load the bare hash using --format=raw-md5. I
>> really like it this way so I think I disagree with the above idea.
>
> The difference here is that you don't have a string for hmac-md5, you
> have two strings. So you need to combine them into one string. At
> this step you decide inn which order to concatenate strings and which
> separator to use. Adding some prefix doesn't change much.
I have no idea why this bothers you this much, but I do not object. Feel
free to submit a patch that fixes this issue, and I will apply it!
magnum
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
