[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 20 Nov 2015 08:23:51 +0100
From: Frank Dittrich <frank.dittrich@...lbox.org>
To: john-users@...ts.openwall.com
Subject: Re: password cracking as a subset of hash searching
On 11/20/2015 08:09 AM, Royce Williams wrote:
> In this blog post:
>
> http://roycebits.blogspot.com/2015/10/hash-filtering-more-than-vanity.html
>
> ... I argue that password cracking frameworks should start to
> incorporate searching for partial matches of hashes -- vanity hashes,
> partial collisions, hashes that mask specific masks, etc.
>
> In other words, I see password cracking (searching for hashes that
> exactly match known hashes) as part of a larger class of activities
> (searching for hashes with specific properties), and see potential for
> cross-pollination with related work that would ultimately benefit the
> project. I point out some recent examples in the post.
If you are just interested to have a certain string in your hash, why
not just provide an appropriate salt when computing that hash?
Since the salt needs to be encoded in the hash, you can be sure that
string will be part of the hash, no matter what password you use.
OTOH, this will increase the risk of hash collisions, i.e., an attacker
can crack 100 hashes with 0xdeadbeef as a salt at the cost of just one
regular hash.
Frank
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
