Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 6 Aug 2013 01:03:18 +0200
From: Frank Dittrich <>
Subject: Re: Duplicate and Uppercase

On 08/05/2013 11:56 PM, Sergey V. wrote:
> On 2013-08-05 at 17:36:17, Rich Rumble <> wrote:
>> ebabyEBABY
>> ellenELLEN
>> intelINTEL
> [04:26:39] <fd>	<5>3ld'*MT4T5T6T7Q
> [04:26:42] <fd>	<6>4ld'*MT5T6T7T8T9Q
> [04:26:44] <fd>	<7>5ld'*MT6T7T8T9TATBQ
> [04:26:47] <fd>	<8>6ld'*MT7T8T9TATBTCTDQ

This is what I used during the contest, but Solar pointed out a better

<* >2 !?A l M u Q X0z0 <+

reject word unless it is still than max. pw length.
reject words shorter than 3 bytes.
reject words that contain any characters which aren't letters.
lower case the word
memorize the word
upper case the word
reject unless the word hash changed (should always be true due to !?A in
the rule)
Insert the memorized word (actually, the substring starting at offset 0
and ending at max. length) into position 0
reject if resulting word exceeds max. length supported by the hash
format (implementation)

If you don't want to reject a word because the duplicated result is too
long, just omit the <+ at the end.
(The only case where omitting the <+ makes sense is probably for
descrypt (formerly known as DES).
The password is cut to length 5, but the user doesn't necessarily know it.)


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.