Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 6 Sep 2015 13:24:09 -0500
From: JimF <jfoug@....net>
To: john-dev@...ts.openwall.com
Subject: Re: FormSpring valid()

c5fea65 fixes this issue.  formspring format will only validate 2 byte 
salts now.  No more, no less.
It still does have to call dynamic valid (which does all the heavy 
lifting), but then does an
additional check back in the format.

In hind sight (while writing the reply), I probably could have forced a 
2 byte salt length within
the 'undocumented' dyna structure after calling dyna_link to link it, 
but that may also
have bad side effect of truncating the dyna_61 to a fixed 2 byte salt.  
I have not looked
at code, just thinking out loud.  BUT, the code is done and works fine 
the way it is.
Just a small length check within the valid function in formspring_fmt.c

I left the longer hashes in the test array, but comment out, and with a 
comment that these
do not work, too long of a salt.  They were originally created with 
pass_gen, without using
an override flag that would have forced pass_gen to only use 2 byte salts.

On 9/6/2015 12:28 PM, Solar Designer wrote:
> magnum -
>
> On Tue, Sep 01, 2015 at 03:47:23PM +0800, Kai Zhao wrote:
>> On Tue, Sep 1, 2015 at 3:21 PM, magnum <john.magnum@...hmail.com> wrote:
>>> I do not know but I think there should be an issue for finding out (or it
>>> will be forgotten).
>>>
>>> The existing untagged test vector only has a salt length of two, I wonder if
>>> that is the difference? Maybe real Formspring hashes have that limitation?
>> I opened an issue for this:
>>
>> https://github.com/magnumripper/JohnTheRipper/issues/1725
> Your comment:
>
> "I see now formspring defines SALT_SIZE as 2. Doesn't look like a bug to
> me, your test vector simply didn't fit the format."
>
> does not address the issue of the format accepting strings with longer
> salts.  Maybe the bug is that this format's valid() (which builds upon
> the dynamic stuff and thus isn't easy for me to follow) sometimes
> accepts invalid strings as well (just not all the time, which is why Kai
> felt that something was wrong)?  And some of the currently listed test
> vectors are in fact invalid.  I think you should re-open the issue.
>
> Kai - how did you obtain the test vectors that you added to
> formspring_fmt_plug.c in 101bed96efba9509f5f60447a342a00024bba17e?
> Specifically, where did their salts come from?  Why are they of 8 hex
> digits whereas the existing test vectors used two-char salts?
>
> Alexander

Powered by blists - more mailing lists

Your e-mail address:

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.