Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 28 May 2019 08:53:58 -0500
From: jfoug <>
Subject: Re: SSHA256 (32bit hash, 32bit salt)

>> I think the issue is the salt is 32bit.
> It's actually 32 bytes, or 256-bit.
> What kind of system did this hash come from?  Should we add better
> support for it to JtR, so that the re-encoding would be unnecessary?
> I notice we have support for hashes tagged {SSHA} and {SSHA512}, but
> currently not for {SSHA256}.
> Alexander

If we were looking at using dyn-62 for this, the way (ATM) to do this is 
to create a thin format. What a thin format does is somewhat like 
overloading within C++.  It takes dynamic as the 'base' class, and then 
overrides a few functions.  Usually, valid() and prepare() are the main 
overloads required.  All of the other format methods point to the 
'normal' dynamic methods.   So when john reads the input file, it sees 
the {SHA256}base64 signature and valid says it knows this one. Then the 
prepare will perform the conversion just like Solar showed in his perl 
script, but that conversion is done automatically.  Then dynamic simply 
'works', because it knows how to do SHA256($p.$s) using dyna-62 script.

This could easily also be done with a 'thick' normal format (not using 

However, if this is not going to be a common format (say it was used 
specifically by one company and will not really be ITW), then building a 
thin format may not really make sense.

The problems 'assuming' that {SSHA256} will always mean the same thing 
can be a crap shoot.  Unless it was used (and then having the hash 
format 'documented'), it could be {SSHA256}base64(pass.hash)   
{SSHA256}base64(pass).base64(salt) {SSHA256}base64(salt.hash)  , etc, 
etc.  Or even use the salt literally, or be in hex, or use some other 
bizzare base64 encoding like the 'crypt*' encodings do.

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.