Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 8 Nov 2016 09:58:38 -0600
From: jfoug <jfoug@...nwall.net>
To: john-users@...ts.openwall.com
Subject: Re: John stuck on the same range

It is more 'efficient' for slow hashes (bcrypt is VERY slow), to do it 
this way.   But for fast and even medium fast salted hashes, it will 
crack quite a few more passwords leaving it in the current default (but 
the runtime is quite a bit slower, if there are many cracks).

HOWEVER, even for the cases where it is fast, if we did change the 
single mode to NOT automatically do this, within jumbo, we have an added 
functionality mode called loopback.  Loopback will properly re-run found 
candidates, playing them right back against all uncracked candidates, 
along with allowing rules, and other things to also be used.    IMHO, it 
is much better (will crack more), to have single run with 
"SingleRetestGuessed = N", and then run a loopback mode after the fact.

The things that affect overall single running are:

- Speed of "single salt"
- number of input hashes
- How much information (user, GECOS, etc) words on average there are for 
each user. I believe john core will limit itself to a small number of 
words max (6?). John jumbo has john.conf params which allow a user to 
set this number up or down, or even turn off using data from some hash 
fields.

The single mode is VERY (VERY) powerful, especially against a very large 
db of very slow hashes.  I made many of these 'changes' to john jumbo 
(the config overrides), when working with single mode in the AM dump 
(27million bcrypt-32 hashes).  Cracking worked, but very slowly.  By 
making changes (these override additions), I was able to speed things up 
quite a bit, due to not having to run found words against all the entire 
27 million (which would take about 3 weeks to run 3 words).  I ended up 
cracking about 2million of these bcrypt-32's before finding a much 
better way (simpler salted md5, that was 'left over' from a prior 
algorithm).    But on a very slow hash like that, and against such a 
huge list, the replaying of candidates, these overrides are required.

Jim.


On 11/8/2016 9:03 AM, Eugene Yarmash wrote:
> Thanks. How about making this a default? Seems much more efficient 
> (and expected, perhaps).
>
>
> On 11/08/2016 01:50 AM, magnum wrote:
>> In Jumbo you can actally have this without a hack/recompile. Just 
>> un-comment the "SingleRetestGuessed = N" in john.conf. You can also 
>> tune down (or up) the SingleWordsPairMax or skip the login field with 
>> SingleSkipLogin (if you already did a run with eg. login field only).
>>
>> magnum
>>
>

Powered by blists - more mailing lists

Your e-mail address:

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.