Date: Sun, 16 Oct 2011 17:55:25 -0400 From: Brad Tilley <brad@...ystems.com> To: john-users@...ts.openwall.com Subject: Re: filter performances On 10/16/2011 05:11 PM, Jérôme Loyet wrote: > Hi guys, > > I'm new to jtr and I'm facing some performance problems (I think we > all do somehow) > > I have a single traditional DES password to bruteforce. I know its > policy: 8 characters long (or more) and it uses at least one lower > case, one upper case, one numerical and one "other" char. > > If I'm bruteforcing using the mode All (with a fixed 8 chars len) I > have 95^8 = 6634204312890625 possibilities > > I want to reduce the number of tries as I know the policy. I have > 95^4*26*26*33*10 = 18170005425000 possibilities How'd you come up with this calculation? I don't think it's accurate as any char position in the password could be chosen from the 95 chars. This is correct: char 1 (95 possibilities) char 2 (95 possibilities) char 3 (95 possibilities) char 4 (95 possibilities) char 5 (95 possibilities) char 6 (95 possibilities) char 7 (95 possibilities) char 8 (95 possibilities) This is not correct: char 1 (95 possibilities) char 2 (95 possibilities) char 3 (95 possibilities) char 4 (95 possibilities) char 5 (26 possibilities) char 6 (26 possibilities) char 7 (33 possibilities) char 8 (10 possibilities) Also, what about the (or more) length passwords. Nine, ten, eleven or twelve char passwords? IMO, brute force is not the way to approach passwords of this lenght. Start with popular passwords, then move to dictionary attacks, word mangling, etc. Hope this helps, Brad <snip>
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.