Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 14 Oct 2017 02:28:50 +0200
From: magnum <>
Subject: Re: Hex-encoding of words

On 2017-10-13 20:24, Albert Veli wrote:
> During the recent passwordctf I used john in parallell with hashcat and
> noticed that hashcat encodes some words using hex format.
> Pasted from IRC:
> 20:04 < trebla> btw, there are some passwords that I found with hashcat
> that can't be sent as ascii or utf-8, for instance:
> 20:04 < trebla> a7b12496acf916b593bda55d3b7562dcc7c9c337:$HEX[7300733932]
> 20:04 < trebla> aa6122c3e8239538db9beff5fd4ca1e4e77045d9:$HEX[3434003536]
> 20:04 < trebla> e15310184d6a28e3c043a462c06d61e2e2a28b98:$HEX[2d002d3933]
> What is your opinion on supporting this hex-syntax for john? It would make
> interoperability between john and hashcat easier.

Yup, we already have it as

> The obvious corner case to look out for is if the password actually begins
> with the ascii string '$HEX[' :-)

Right, we have discussed that in #2354.

> In that case john has to make sure it is always encoded using hex format,
> for instance like this:
> $HEX[244845585b6a6f686e5d]
> The password in this case would be:
>   echo '244845585b6a6f686e5d' | xxd -r -ps
> $HEX[john]

I think there are more caveats than that, but we should still add this 
feature. The main problem is the only active developers right now are me 
and Dhiru, and Dhiru isn't very fond of touching core code. So it's just 
me, and I have my hands full with other stuff.

BTW another problem is our current core code wouldn't allow eg. nulls in 
passwords regardless of this feature. I think hashcat does. OTOH I don't 
see much gain in fixing that. It would be fairly trivial but a massive 
edit (changing 500 files or so).


Powered by blists - more mailing lists

Your e-mail address:

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.