[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120620002436.GD19985@openwall.com>
Date: Wed, 20 Jun 2012 04:24:36 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Cc: hashrunner@...ecurity.com
Subject: Re: PHDays Hash Runner challenge
On Tue, Jun 19, 2012 at 01:10:38PM +0400, Elijah [W&P] wrote:
> and finally here are the rules with all the detailed stats/graphs
> http://phdays.com/program/contests/hashrunner/stat/
Great. I like how the results are presented.
It is curious that InsidePro Team 2012 cracked many more GOST hashes
than we did, even though we had 10x faster code for GOST. This shows
that they're much more skilled at directing the attacks.
Speaking of the released plaintexts, it is now clear why none of the DES
crypt hashes were cracked - those passwords were simply too complicated
to be worth cracking in the contest, compared to other hash types'
passwords. A few could be cracked if people tried really hard, but that
was non-obvious (another guess was that the hashes were somehow mangled)
and like I said it would be unreasonable (not worth it).
For bcrypt hashes, I think a few (very few) could reasonably be cracked.
There were some passwords that could be picked up with a simple English
wordlist and an average ruleset (something inbetween John's default
"wordlist" and "single" mode rulesets).
This approach of the contest organizers I strongly disagree with:
"- empty or equal salts and empty usernames were introduced to
compensate point values between some hash types, where cracking speed
differed to much."
This made the contest hashes even more non-realistic than they would
otherwise (have to) be. As a result, the per-hash statistics are a lot
less valuable - they're not useful as material to refer to in
real-world contexts. So I won't be able to do something like this:
http://www.openwall.com/presentations/PHDays2012-Password-Security/mgp00027.html
(analysis of KoreLogic's DEFCON 2010 contest passwords for two different
hash types - to see how the hash type matters).
If any compensation for/against some property of a hash type or whatever
is included, it must be solely in the points system.
That said, it is great that this contest took place. It may have helped
us prepare for KoreLogic's contest at DEFCON 2012. ;-)
Thanks,
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
