john-users - HMAC MD5, maybe?

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 18 Jun 2013 09:02:38 -0700
From: Howard Chu <hyc@...hlandsun.com>
To: john-users@...ts.openwall.com
Subject: HMAC MD5, maybe?

I've got a data file (stored as an SQLite database) where a number of rows are 
protected by a hash. I'd like suggestions on how to configure JtR to discover 
the missing inputs to the hash. E.g., here's a (dummy) table definition:

CREATE TABLE `my_table` (`target_id` VARCHAR , `object_id` VARCHAR , `number` 
INTEGER , `my_table_id` INTEGER , `hash` VARCHAR , PRIMARY KEY (`my_table_id`) );

and a couple (fake) rows
INSERT INTO "my_table" 
VALUES('thing1','attr1',2,1,'d82a4b9ee2bd0842f7a83da4afcad550');
INSERT INTO "my_table" 
VALUES('thing1','attr2',2,2,'2cf891faea7180a2f89f8fc4198de7de');

I'm assuming the hash was generated based on the other columns of the table, 
but I don't know in what format (e.g., are the integers converted to strings 
first, or are they hashed as 32 bint binary values), what order the fields are 
summed, and what delimiters might be in use. I don't know if the table name is 
part of the hash. I don't know if some secret seed is prepended or appended to 
the plaintext.

How would you suggest tackling this?

Thanks for any advice.
   -- Howard

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.