Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 16 Feb 2013 10:50:46 +0100
From: Frank Dittrich <frank_dittrich@...mail.com>
To: john-users@...ts.openwall.com
Subject: Re: SSHA-512 supported?

On 02/15/2013 08:12 PM, Jon Schipp wrote:
> /usr/bin/time ../AIXtest '{ssha512}01$................$'
> 
> xpIxEcaCjtQ.Y
> 
> Real   17.03
> User   13.33
> System 0.46
[...]
> /usr/bin/time ../AIXtest '{ssha512}06$.$'
> vYRg99ZbtBAGo

OK, so checking the validity of salt and iteration count is done inside
crypt(). That means, we won't get any data for "simpler" input than what
is allowed by the specification.

What is the output of
./AIXtest '{ssha512}04$................$' | wc -l
./AIXtest '{ssha512}05$................$' | wc -l
./AIXtest '{ssha512}06$................$' | wc -l

>From your "./AIXtest | head" samples, it looks like there are about 4
times as many {ssha512}06$ lines containing the "..." sequence than
there are for {ssha512}04$. I just want to know if this assumption is
true when processing the larger set of input words as well.
The higher frequency of hashes containing "..."  (7 hashes for passwords
"0" - "75" vs. 7 hashes for passwords "0" - "303") could just be a
coincidence. Without testing a larger set of passwords, we won't know.
If from 04 to 05 to 06 the number increases significantly, and you can
afford to spend even more run time, these might be interesting as well:
./AIXtest '{ssha512}07$................$' | wc -l
./AIXtest '{ssha512}08$................$' | wc -l
If not, just skip these tests (or just skip the last, slowest one).

Thanks

Frank

Powered by blists - more mailing lists

Your e-mail address:

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.