[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20060530132349.GA29897@openwall.com>
Date: Tue, 30 May 2006 17:23:49 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: How does it actually dictionary attack salted hashes?
Randy B has already provided a response (thanks!), but I'll illustrate
it using the specific example from John Paine's posting:
On Mon, May 29, 2006 at 04:58:06PM -0400, John Paine wrote:
> If Unix password hashes normally contain a 12 bit salt, how can JTR, or any
> other cracking program who excepts /etc/shadow lines, be effective at
> allowing a user to supply a dictionary list? Lets say for example the salt
> was 'foobar' and the password was 'password'. How do these cracking program
> allow a dictionary list to be run on a hash such as foobarpasswordfoobar?
Obviously, the traditional crypt(3) with 12-bit salts does not use salts
like "foobar" and it does not simply concatenate salts with plaintext
passwords like in "foobarpasswordfoobar", but I'll use this example
anyway - just speaking of some abstract password hashing method.
Let's assume that our wordlist contains these lines:
12345
abc123
password
... and so on
(these are the first 3 lines from the common passwords list included
with John the Ripper 1.7). Also, let's assume that we're cracking one
password hash, having a salt of "foobar", and the password from which
this hash was produced is "password". The salt "foobar" is known to us
since salts are typically stored along with the actual hashes.
JtR can pick the first line from the wordlist - "12345" - and compute
its hash, using the known hashing method and the known salt "foobar".
Then it can compare the computed hash against the one it is cracking.
It will most likely see that they're different and conclude that the
password is not "12345". So it picks the second line - "abc123" - and
repeats the same check, resulting in the same conclusion. When it gets
to the third line, the computed hash will finally match the one being
cracked - so JtR will know that "password" is a valid password for the
given hash.
In practice, JtR may work a bit differently, computing multiple hashes
simultaneously and not doing the comparisons directly, but the above
description should be good enough to answer your question.
> I can see how brute forcing would work ...
As Randy has correctly pointed out, "brute-forcing" is not in any way
different as far as your question is concerned. Perhaps you thought
that it would need to somehow crack the salts along with the passwords?
Well, this is not the case - the salts are readily known.
--
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598 fp: 6429 0D7E F130 C13E C929 6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments
Was I helpful? Please give your feedback here: http://rate.affero.net/solar
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
