Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 16 Apr 2013 17:09:59 -0500
From: "jfoug" <jfoug@....net>
To: <john-dev@...ts.openwall.com>
Subject: RE: Bug report: specific hex salted hash failure

From: john user Sent: Tuesday, April 16, 2013 16:12
>
>I am just very curious why only a specific salt value fails.
>
>also can play with these 3 byte salt values below which are an issue to me.
>
>$Uc
>$2O
>$2S
>$2n
>$Ux
>$2w
>$U_
>$Uj
>$22
>$U&
>
> if any devel could look at this it would be appreciated.

These simply will not work properly with dynamic, at this time.  The bug is
in the salt() function.  By the time we get to the salt() function, dynamic
has already stripped off the $HEX$ and change it into 'normal' text.

So, what this gets done, is we change:

$dynamic_1007$00000000000000000000000000000000$HEX$24324f

into

$dynamic_1007$00000000000000000000000000000000$$2O

What you have is $$2 is the signature to a 2nd salt.  We would 'expect' the
salt to be $2O, but within salt() function, it is interpreted as a 2nd salt
with the value of O.

I will have to look at how to work around this issue.  Having a generic
format, that allows as much as it does, yet having to handle all binary
salts like this, is not a trivial undertaking.

This is a simple test line, when added to dynamic.conf, that shows this bug.
It uses the $2O salt.

Test=$dynamic_1007$5dd8145e0d1e2499bce05dcb4bce5cdf$HEX$24324F:testme

Jim.

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.