Date: Tue, 20 Nov 2012 06:27:27 +0100 From: Frank Dittrich <frank_dittrich@...mail.com> To: john-users@...ts.openwall.com Subject: Re: How does incremental mode works? On 11/19/2012 11:52 PM, Richard Miles wrote: > 2) Suppose that I will generate a dictionary following my password policy > enforcement, for example: > > - All passwords must be at least 6 chars long. > - At least 1 number. > - At least one capital letter. > > And I will use this dictionary to generate a stats file and I also define > that under Markov configuration no passwords with 6 chars should be > generated / tested. > > My question is, all candidates generated by Markov on this conditions will > always contains at least 1 number and 1 capital letter? No, of course they won't. Markov mode takes into account frequency information about up to 2 characters. So, when possible candidates for the 5ths character are calculated, it considers probability of different characters following the character that has been used as the 4th character (plus the markov level reached when adding the 5th character). Whether or not any of the previous characters has been a digit or an upper case letter doesn't matter. On the other hand, you might end up with lots of passwords adding a digit at position 2 or 3, while most of your real passwords which were used to generate the stats file only contained digits at the begin or at the end of the password. This is because Markov mode, unlike incremental mode, doesn't use frequency information based on the current offset or on word length. Frank
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.