Date: Mon, 4 May 2020 23:24:38 +0200 From: Solar Designer <solar@...nwall.com> To: john-users@...ts.openwall.com Subject: Re: Is the example of HMAC-SHA512 right? On Mon, May 04, 2020 at 11:33:47PM +0800, gyula wrote: > Hello, I'm trying to crack a hash encryted by HMAC-SHA512. You must mean "computed", not "encrypted". HMAC doesn't encrypt. > I use the command, "john --list=--list=format-details |grep HMAC-SHA512", to search the example of it. > > The example hash is below. > > "what do ya want for nothing?#164b7a7bfcf819e2e395fbe73b56e0a387bd64222e831fd610270cd7ea2505549758bf75c05a994a6d034f65f8f0e6fdcaeab1a34d4a6b4b636e070a38bce737" Yes, that's our first test vector for HMAC-SHA512. I vaguely recall that it came from some password cracking contest. > I don't konw the meaning of "what do ya want for nothing?#". The rest is the hex form of hash, I think. > Moreover, I can't find the salt. That cryptic string "what do ya want for nothing?#" is what we process as salt in this example. > When I crack it with John The Ripper, It cracked. The result is Jefe. That's correct. > I want to konw how to format a line with a hash from hmac-sha512 and a salt, then crack it. The format is: salt#hashinhex Some unrequested detail: BTW, as a special case, the salt may have a "#" embedded in it - that's fine, we use the last occurrence of a "#" in the string as the delimiter between salt and hash. HMAC is defined as operating on key and data, not on password and salt, and its direct uses for password hashing are actually misuses. The way we support cracking of HMAC-* in JtR is treating password as key and salt as data. This appears to match the demand so far, although it's conceivable that the other order of these parameters would be used somewhere and would need to be supported in JtR, which it unfortunately is not. Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.