Date: Tue, 8 Apr 2014 10:14:40 -0400 From: Rich Rumble <richrumble@...il.com> To: john-users@...ts.openwall.com Subject: Re: Secure Mode for John On Sun, Mar 2, 2014 at 8:51 PM, Mark Butler <markb@....ibm.com> wrote: > > A first try is now committed to bleeding-jumbo. Enable by setting > > SecureMode=Y in john.conf. > I like this mode, however, what could be done about sharing the hashes when you have to distribute, but you do not want the hashes to work if this JtR mode isn't enabled? This would require a bit of effort, and I'm just spit-balling, but could GPG be used to encrypt the hashes I want to distribute, and be decrypted in memory (using some --pub-key option) so that they can then be tried in JtR? Could the same public key be used to encrypt the cracked hashes, so that the original private key can then decrypt them if need be? I know all this adds cycles and takes resources away from the cracking, but it's a mode I'd be interested in using. I think it would could be a more responsible method of full-disclosure where you ask for public participation. I have no illusions that a further modified version of JtR or someone using a debugger etc would be unable to get the decrypted hashes from memory (or write them to disk/pagefile etc). There may not be a need/want for it, or it's going overboard, but I thought I'd put the idea out there. ./john passes.txt --pub-key=pubkey.gpg --pot=secure.pot -rich
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.