Date: Wed, 23 Jan 2013 16:17:05 +0100 From: Frank Dittrich <frank_dittrich@...mail.com> To: john-dev@...ts.openwall.com Subject: Re: Min password length On 01/23/2013 02:45 PM, jfoug@....net wrote: > What about formats which have a min password length? Do we have a mechanism to tell JtR to not try any words that are shorter than X bytes long? I know we have external filters to force this, but that is not the question. Do we have a way to automatically do this? > > There are algorithms that specify minimal, so trying words less than the min length is a total waste of resources. What formats are affected? Do you know for sure that older versions of the OS or application didn't allow shorter passwords? Is the policy only checked when a new password is created by a user? Or also when an admin sets the password for a user. What if someone manages to directly change an existing hash? (Is the password policy also enforced during login?) I know of sapG (which should have been named sapF instead). Minimum password length is 3. But the password policy is not checked during login. So, if there is a user "F" and you change the hash to "646A0AD270DF651065669A45D171EDD62DFE39A1", the user can still logon with password "X". (The same is true for user "MAN", hash "22886450D0AB90FDA7F91C4F3DD5619175B372EA" and password "u".) For sapB, the minimum password length is 1. (User "F" picked password "x Y". The system computes the CODVN F or CODVN I hash for this password. Depending on release and system configuration, the system also computes and stores the CODVN B hash (replacing non-ASCII characters in the password with '^', truncating the password to 8 characters, translating it to upper case, removing trailing spaces.) You cannot have an empty password. You wouldn't be able to login without specifying a password. SAP passwords have other limitations. E.g., the first character cannot be '!' or '?'. Frank
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.