[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 17 Jun 2015 00:19:21 +0200
From: magnum <john.magnum@...hmail.com>
To: john-dev@...ts.openwall.com
Subject: #saltfail
Nice post by Atom
http://hashcat.net/forum/thread-4429.html
The context is ColdFusion's sha256($salt.sha1($pass)) but the hash
functions are not important, it applies to things like MD5(salt.pass) as
well. The flaw is it's a salt with a length that "equals or is greater
than the blocksize of the hash" and that it's prepended to the password,
as opposed to appended. This means, in JtR context, we can run the first
digest operation in get_salt() and get it completely out of the hot loops.
We have formats that already use this optimization but we probably have
some that don't. We should list them and fix them.
magnum
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
