Date: Sat, 08 Sep 2012 12:59:07 +0400 From: Alexander Cherepanov <cherepan@...me.ru> To: john-dev@...ts.openwall.com Subject: Re: Formatting hashes On 2012-09-08 09:44, Dhiru Kholia wrote: > On Sat, Sep 8, 2012 at 4:23 AM, Alexander Cherepanov <cherepan@...me.ru> wrote: >> Is including lengths into the hash really useful? Isn't it better to use >> just $ between parts like this: > > I don't know if salt length is fixed (most likely it is). It doesn't matter. > Hence, I included salt length in the hash. I agree that 'entropy' > length can be skipped. Why do you need lengths at all? Sure it's necessary to be able to parse a hash string and extract different parts from it. For this, one can use separators between parts, or lengths written before parts, or pointers to different parts, or something. But you use both separators and lengths which IMHO is excessive. Having only separators is enough. Look at how other salted hashes are formatted. You have already posted in this thread an example of this same hash formatted as grub_pbkdf2_sha512 -- there are no lengths in it. Another similar example is sha512crypt: $6$rounds=5000$ojWH1AiTee9x1peC$QVEnTvRVlPRhcLQCk/HnHaZmlGAAjCfrAN0FtOsOnUk5K5Bn/9eLHHiRzrTzaIKjW9NTLNIBUCtNVOowWS2mN. (example from cryptsha512_fmt_plug.c with "rounds=5000$" inserted). BTW it's much shorter. Or put it another way: right now you need to code parsing the length out of a string, skip the separator after it (whether it's just scanf or not), check for errors in the process and check that the length is not excessive. After you know the length of the field you need to read that much bytes from the string, check that that the string is not exhausted in the process and that there is a separator after the field. Why bother? Just read the string until you meet a separator (and check that you didn't overfull the target buffer in the process). Sometimes it's good to know the length in advance, say, to allocate memory. But you operate mostly on fixed-length buffers in john. Are there other reasons to get lengths in hash strings? -- Alexander Cherepanov
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.