Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 5 Aug 2012 17:44:45 +0530
From: Dhiru Kholia <>
Subject: Re: OS X keychain single empty/spaces result, but
 guessing continues?

On Sun, Aug 5, 2012 at 5:41 AM, Royce Williams <> wrote:
> I'm working on a Mac OS X keychain recovery.  The target file was
> generated with keychain2john from an unaltered login.keychain.
> $ john -i=all keychain.txt
> Loaded 1 password hash (Mac OS X Keychain PBKDF2-HMAC-SHA-1 3DES [32/64])
> ... but shortly afterwards, the following appears (preceded by 17 spaces):
>                  (login.keychain)

Was the actual password different from what john printed? Can you feed
your actual password to john and see if john cracks login.keychain
successfully or not?

Currently, the Keychain format is FMT_NOT_EXACT which means that we
can't be 100% sure that the recovered password was the actual
password. Hence, john continues to run after the initial guess.


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.