Date: Sat, 13 Jun 2009 13:40:25 +0400 From: Solar Designer <solar@...nwall.com> To: john-users@...ts.openwall.com Subject: Re: cracking MD5 hashes more than 8 characters long with a dictionary On Sat, Jun 13, 2009 at 11:22:35AM +0300, Antonios F. Atlasis wrote: > checking (counting) the precise length of these passwords, this is > exactly 16 characters. Hence, I suppose this is due to the limitation > that you mentioned concerning the MD5, right? That's correct. Only passwords of up to 15 characters long (inclusive) will be cracked by current versions of JtR when you're dealing with the MD5-based crypt hashes. > A limitation that > obviously does not exist in Blowfish implementation, I guess. Correct. > Is there any work-around on this? No, the existing MD5-based crypt code is fundamentally limited in this way. Computing hashes of this type of passwords of 16 characters or more would require more code (or different code) and would be roughly twice slower. Most of the time, checking twice more candidate passwords of lengths up to 15 is preferable over checking some candidate passwords of length 16 and above, because shorter passwords are usually also the weaker ones (exceptions do exist, though). Alexander P.S. When you reply to a posting on this list, please be careful to quote relevant context only, like I did above. Please do not over-quote. -- To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.