Date: Sun, 16 Aug 2015 17:16:29 +0300 From: Solar Designer <solar@...nwall.com> To: john-dev@...ts.openwall.com Subject: Re: testing every index (Re: more robustness) Kai, On Sun, Aug 16, 2015 at 09:04:26AM +0800, Kai Zhao wrote: > On Sun, Aug 16, 2015 at 12:33 AM, Solar Designer <solar@...nwall.com> wrote: > > Have you since implemented testing of every index (in the range of 0 to > > max_keys_per_crypt) when running with --test-full? Where is it in code? > > > > I recall us finding one bug in this way, but I don't see it in code. > > Yes, we did. The code is in formats.c:: 1196~1211 > First, set (max - 1) keys by longcand, then set the last keys which is the > right key. That's not what I had meant. It's not testing every index - it's testing the last index only, and only with a correct password in it. Looks like nothing has been done on the original task, and you have yet to take care of it. We need to test that in every index a correct password is detected as such, and an incorrect password is detected as such as well. To speed this up and to mimic actual cracking, you should set and test passwords in all indices at once. In order to test every index in both ways, you will need to invoke crypt_all() at least twice. If you do it exactly twice, then you need to invert the selection of which indices hold correct vs. incorrect passwords between the two crypt_all() calls. Will you implement this soon, please? Thanks, Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.