[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <BLU0-SMTP329FE4EEC93546FFF64E898FD3F0@phx.gbl>
Date: Tue, 17 Apr 2012 22:03:26 +0200
From: Frank Dittrich <frank_dittrich@...mail.com>
To: john-users@...ts.openwall.com
Subject: Re: .chr files
On 04/17/2012 12:11 AM, Stephen John Smoogen wrote:
> On 16 April 2012 02:43, Simon Marechal <simon@...quise.net> wrote:
>> On 16/04/2012 00:01, Frank Dittrich wrote:
>>> So may be we might need some tests on real-life passwords.
>>> Either a large set of saltless hashes, or even a large list of cracked
>>> passwords from various hashes, converted for --format=dummy.
>>
>> This :
>>
>> https://www.korelogic.com/InfoSecSouthwest2012_Ripe_Hashes.html
>>
>
> In going through this data.. I think there is a lot of chaff in the
> md5 passwords. It looked actually like someone had taken the KoreLogic
> dictionary set from the 2010 contests and md5sum'd it 1:1. While some
> of those are probably passwords.. other items (like the md5summing of
> all the facebook accounts) might introduce more noise than is useful.
OK, so these hashes might be a questionable source of real-life passwords.
Nevertheless, they can be useful for our tests:
-check whether implemented algorithms work correctly
-check whether they scale well with increasing data volumes
-see whether rules priority determined automatically during the cracking
attempts of a first random sample of hashes work as expected on other
random samples of the remaining hashes
-see whether chr files generated based on passwords cracked from the
first sample of hashes are well suited for the remaining hashes
-test how many additional passwords of a sample have to be cracked so
that the resulting chr file is better suited for cracking the remaining
hashes than the previous chr file generated from a smaller sample of
cracked passwords
-test at which point overlapping password candidates generated by
incremental modes using those two chr files become a problem which makes
continuing the incremental mode session pointless
We just shouldn't expect these tests to provide chr files or a set of
rules which are useful for other hashes except those from the KoreLogic
torrent.
Of course, if we find a large set of saltless hashes which more reliably
represent real-life passwords, we should use this one instead.
Frank
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
