Date: Mon, 7 Dec 2009 01:08:40 +0100 From: "Luke O'Connor" <lukejamesoconnor@...il.com> To: john-users@...ts.openwall.com Subject: password ranking Hello everyone, I used to be involved in cryptographic research, and still retain a strong interest in password, in particular around the analysis of password guessing, the size of password spaces defined by policies and so on. What I was wondering was whether there is a document which describes the search strategy that is followed by JtR. I see from the documentation pages that many search options can be configured but I was hoping someone could give me a simple answer based on standard settings (if they exist). Imagine that I start JtR to search for a password like 8h2wt6ghw - expressed as windows hash for example - how many guesses will JtR make before the password will be found? Let's for the moment assume that JtR runs indefinitely. I think an interesting measure of password complexity would be some function JtR(Password) which returns the position of Password in the list of candidate passwords generated by JtR according to its search strategy. Is there any analysis along these lines, a document which describes how a given search strategy works its way through the set of all passwords (if it was able to run indefinitely)? Thank you for any pointers. Happy to work with anyone who thinks this would be interesting to figure out in detail if this has not already been done, rgs Luke O'Connor
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.