Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 26 Feb 2014 02:22:31 +0100
From: magnum <>
Subject: Re: Secure Mode for John

On 2014-02-21 00:25, Mark Butler wrote:
>> Date: Tue, 21 Jun 2005 16:28:29 -0400
>> From: Jim Brown <>
>> I've used john in an enterprise environment as a strong
>> password compliance tool and I've had these concerns:
>> 1. The passwords are visibly displayed.
>> 2. The .pot file contains password data that can be displayed
>>     by running john at a later time.
> I would like to revisit the above. Ideally I would like a setting in
> john.conf to be able to turn on Secure Mode for john. I would envisage that
> when it is set, instead of john passing back the clear text password, it
> would pass back attributes of the password instead. Things like length,
> mode john is running in (Single crack [S], Wordlist [W], Incremental [I],
> External [E]) and the rule matched in that mode. eg: L8-W-R13 for a
> password 8 characters in length, cracked in Wordlist mode using rule 13.
> Hopefully all this information is available to john at the time the
> password is cracked.

A first try is now committed to bleeding-jumbo. Enable by setting 
SecureMode=Y in john.conf.

It turned out to be a too intrusive patch writing stuff like modes & 
rule numbers - and you can see such things in the log anyway. What it 
does instead is showing what character classes are involved. Is that too 
much information? For example, the password "Ignit3" would output as 
L6-?l?d?u telling you that it's six characters long and consists of 
lowercase, digits and uppercase characters. It does not hint about order 
or amounts of each class. The classes are printed in mask-mode syntax: 
?l ?u ?d ?s ?a for lower-case, upper-case, digits, specials and 8-bit.

> The flow on effect would be the .pot file would include the encrypted
> password with password attributes instead of the clear text password.

The current patch writes that same "L6-?l?d?u" string to log, pot file 
and to screen. I can't see it go very wrong but everything I do is on a 
best-effort basis so please test ;-)

Oh, and when this is activated, the default potfile is secure.pot so you 
don't accidentally mix formats in john.pot. This can still be overridden 
using --pot=FILE.

Review my patch here:

Snapshot tarball:


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.