Date: Thu, 13 Aug 2015 14:32:05 +0200 From: Frank Dittrich <frank.dittrich@...lbox.org> To: john-dev@...ts.openwall.com Subject: Re: Lei's weekly report #15 On 08/13/2015 02:14 PM, Lei Zhang wrote: > On Aug 13, 2015, at 7:24 PM, Frank Dittrich <frank.dittrich@...lbox.org> wrote: >> >> On 08/13/2015 12:17 PM, Lei Zhang wrote: >>> For example, '€€€€€€€' cannot be cracked, while '€€€€€€' (one less char) can be cracked. >> >> In utf-8, € needs 3 bytes. So, these are 21 bytes which will get >> truncated to 19. > > I'm a bit confused. So this PLAINTEXT_LENGTH limit is byte-wise instead of character-wise? Unfortunately, yes, this functionality has been designed more than 20 years ago, when probably nobody outside China, Japan and a few other countries used multi-byte code pages. . For performance reasons, many format implementations pick a length which allows to hash just one block if the MD5/SHA1/... hash function. The max length issue is complex: First, we do have the max. password length limits of our implementations - usually in bytes, but it could be in characters as well (for formats that internally use a single-byte code page and map the non-ascii to ascii characters (DES converting 8bit into 7bit characters, sapB "mapping" non-ascii characters to '^', etc.). Then we have the max. password length supported by the application where the user enters his password. Old SAP systems have a limit of 8 characters (not bytes), new systems have a limit of 40 characters (not bytes), unless you use some Chinese characters which don't fit into utf-16, then the length is limited to 20 of these characters. And finally, we would have to distinguish between systems where the user is aware of the limitation (i.e., because the input mask doesn't allow entering more characters and systems that silently drop any characters that exceed the application's supported max. password length. And you never know whether a web application has other bugs. I once got a warning that minimum password length is 4, while my password was much longer. I just used either '<' or '>' (don't remember which one) as the third character. Has I used < as the fifth character, my complex password might have been silently converted into a rather simple one. Frank
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.