[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 7 Dec 2009 01:08:40 +0100
From: "Luke O'Connor" <lukejamesoconnor@...il.com>
To: john-users@...ts.openwall.com
Subject: password ranking
Hello everyone,
I used to be involved in cryptographic research, and still retain a strong
interest in password,
in particular around the analysis of password guessing, the size of password
spaces defined
by policies and so on.
What I was wondering was whether there is a document which describes the
search strategy
that is followed by JtR. I see from the documentation pages that many search
options can be
configured but I was hoping someone could give me a simple answer based on
standard settings
(if they exist).
Imagine that I start JtR to search for a password like 8h2wt6ghw - expressed
as windows hash
for example - how many guesses will JtR make before the password will be
found? Let's for the
moment assume that JtR runs indefinitely.
I think an interesting measure of password complexity would be some function
JtR(Password)
which returns the position of Password in the list of candidate passwords
generated by JtR
according to its search strategy.
Is there any analysis along these lines, a document which describes how a
given search strategy
works its way through the set of all passwords (if it was able to run
indefinitely)?
Thank you for any pointers. Happy to work with anyone who thinks this would
be interesting to
figure out in detail if this has not already been done,
rgs Luke O'Connor
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
