Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 13 Aug 2015 19:50:30 +0200
From: magnum <>
Subject: episerver UTF-8 (was: Re: Lei's weekly report #15)

On 2015-08-13 12:17, Lei Zhang wrote:
> On Aug 13, 2015, at 5:26 AM, magnum <> wrote:
>> Maybe you could even add episerver to
> I'm not sure what you mean. I can see episerver is already in
> I don't know if I'm doing it correctly, but that's how I did the test:
> $ cat pw-utf8.dic | ../run/ -utf8 episerver_sha1 >
> $ ../run/john --format=episerver --wordlist=pw-utf8.dic --encoding=utf8

Ah, I just tried " episerver". Good, then it's easy to create 
more test vectors.

> And there're 257 out of 1500 hashes not cracked. I viewed the corresponding uncracked passwords: most of them are long (probably exceed PLAINTEXT_LENGTH), but some are not. For example, '€€€€€€€' cannot be cracked, while '€€€€€€' (one less char) can be cracked. The length of it surely doesn't exceed PLAINTEXT_LENGTH. Is there something special with this string? I feel I'm still missing some point in the UTF8 encoding...

Each '€' results in three bytes of UTF-8. '€€€€€€€' is thus 21 bytes, 
and exceeds PLAINTEXT_LENGTH (which is given in bytes) while '€€€€€€' is 
18 bytes and fits within it. So from the sound of it, your format is AOK.

BTW that's the reason for this, found in all FMT_UTF8 formats:

	if (pers_opts.target_enc == UTF_8)
		self->params.plaintext_length = MIN(125, 3 * PLAINTEXT_LENGTH);

This allows up to 57 bytes of key for up to 19 characters of UTF-8. And 
while Jumbo formats otherwise never need to truncate/check max length, 
UTF-8 formats has to do that, after the above. Because the added room 
for 57 bytes would also allow a plain ASCII key of up to 57 characters - 
which we can't allow writing past buffer!


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.