[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20060122060724.GA4154@openwall.com>
Date: Sun, 22 Jan 2006 09:07:24 +0300
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: Incremental Alpha Quagmire
On Thu, Jan 19, 2006 at 04:37:25PM -0800, Arias Hung wrote:
> On Thu, 19 Jan 2006, Solar Designer delivered in simple text monotype:
>
> >Yes, you may generate a new .chr file with lowercase and uppercase
> >letters. You'd need to define the appropriate external filter() (to use
> >when generating the .chr file) and you need to have all those characters
> >already in your john.pot (or you can use "Extra = ..."). Once again,
> >the resulting .chr file will likely yield a lower success rate (at
> >cracking passwords which you did _not_ already have cracked by the time
> >you generate the .chr file) than the provided all.chr does.
>
> I'm sorry if I find this a bit confusing as to your reference here of
> 'likely yield a lower success rate at cracking passwords WHICH YOU DID _NOT_
> ALREADY HAVE CRACKD by the time your generate the .chr file.
I felt I had to mention this. Of course, cracking certain passwords for
a second time (as a test) using a .chr file generated from those same
passwords might result in a higher success rate, -- but that would not
be a fair test.
> In my case I would be choosing to to generate a .chr file with a fake .pot
> based on my prior knowledge of certain characteristics of the passwords (
> such as
> upper and lower alpha sans additional chraacters or numbers ) the purpose
> being in order to yeild a higher success rate by eliminating what i know
> not to be characteristic of the passwords. I'm confused as to what you're
> referring to in the passwords 'which you did not already have cracked by
> the time of chr file generation' ?!
Well, my "test fairness" comment doesn't fully apply to what you
intend to be doing, but it is not completely irrelevant either. If you
would be using your "prior knowledge of certain characteristics of the
passwords", then you should be testing the resulting .chr file against
password hashes which you either didn't have cracked before or the
characteristics of which you didn't take into account. Otherwise, you
would be merely optimizing a .chr file for a certain set of passwords
which you already know, -- which might or might not result in a higher
success rate at other password hashes.
--
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598 fp: 6429 0D7E F130 C13E C929 6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments
Was I helpful? Please give your feedback here: http://rate.affero.net/solar
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
