Date: Sat, 19 Sep 2015 12:52:39 +0200 From: magnum <john.magnum@...hmail.com> To: john-dev@...ts.openwall.com Subject: Re: fast hash early exit vs. large hash list On 19/09/15 11:17, Aleksey Cherepanov wrote: > On Sat, Sep 19, 2015 at 02:33:21AM +0200, magnum wrote: >> On 18/09/15 17:25, Solar Designer wrote: >>> For raw-md5, we currently have early exit before the last 3 steps. >>> Aside from this being extremely far from what state of the art fast >>> hash crackers do in terms of steps reversal, >> >> Can we reverse any more without considering the actual candidate (or its >> length)? I doubt the shared functions are suitable for hard-core reversal. >> It might be better to do so in formats like the -ng ones that doesn't use >> shared code. Or at least do them first. > > Just some formulas for you convenience: > Reversed algo for last round ([abcd]64 consist hash, [abcd]63 are for > previous state): > > i = 63 > b63 = c64 > c63 = d64 > d63 = a64 > g = 9 > a63 = ror(b64 - c64, s[i]) - (d64 ^ (c64 | (~a64)) + k[i] + m[g]) > > So, not considering candidate (m), we know b63, c63, d63. > (...) > Check against millions of hashes may just need 2 ints, not fully > stored state. This is an important fact, didn't think of that. But it's more branching. Thanks! magnum
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.