Date: Fri, 8 Feb 2013 18:00:53 -0700 From: Stephen John Smoogen <smooge@...il.com> To: john-users@...ts.openwall.com Subject: Re: SSHA-512 supported? On 8 February 2013 17:56, Jon Schipp <jonschipp@...il.com> wrote: > On Fri, Feb 8, 2013 at 7:39 PM, Solar Designer <solar@...nwall.com> wrote: >> On Fri, Feb 08, 2013 at 07:35:22PM -0500, Jon Schipp wrote: >>> In case this helps, from pwdalg.cfg >>> >>> >>> "cost_num=cost >>> * >>> * The default hashing iterations is 2^cost. The valid value of cost is >>> * an integer between 4 and 31, inclusive. The default cost value is 6." >> >> Isn't this written in context of bcrypt hashes (which they call sblowfish)? >> If so, we knew that, but it's irrelevant. > > Lines further down in the config describe the blowfish count: > "The default hashing iterations is 2^cost. The valid value of cost is > an integer between 4 and 31, inclusive. The default cost value is 8." > > A default of 8 instead of 6 previously mentioned. Again, I don't know > if that is helpful or not. > >> Do you suspect they were dumb enough to apply the same low iteration >> counts for sha512crypt, where each iteration is a lot cheaper? Well, >> maybe. Got to test the 1 to 999 range. > > I'm curious and not a programmer, what do you mean by "where each > iteration is a lot cheaper"? How are they cheaper? Ok so if this is basically saying how many times you are going to run through your hash to get an answer. 4 = 2^4 = 32 6 = 2^6 = 64 8 = 2^8 = 256 so less rounds means the CPU is doing less work and thus it is cheaper. You want to have LOTS of rounds if you want to hash something that is expensive for a cracker.. so something like 10 as a minimum (1000) versus 64. > Thanks > Jon -- Stephen J Smoogen. "Don't derail a useful feature for the 99% because you're not in it." Linus Torvalds "Years ago my mother used to say to me,... Elwood, you must be oh so smart or oh so pleasant. Well, for years I was smart. I recommend pleasant. You may quote me." —James Stewart as Elwood P. Dowd
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.