[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 20 Nov 2015 19:45:37 +0100
From: Marek Wrzosek <marek.wrzosek@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: password cracking as a subset of hash searching
W dniu 20.11.2015 o 18:45, Royce Williams pisze:
> On Fri, Nov 20, 2015 at 8:40 AM, Rich Rumble <richrumble@...il.com> wrote:
>>
>> On Fri, Nov 20, 2015 at 2:49 AM, magnum <john.magnum@...hmail.com> wrote:
>>
>>> On 2015-11-20 08:23, Frank Dittrich wrote:
>>>
>>>> On 11/20/2015 08:09 AM, Royce Williams wrote:
>>>>
>>>>> In this blog post:
>>>>>
>>>>>
>>>>> http://roycebits.blogspot.com/2015/10/hash-filtering-more-than-vanity.html
>>>>>
>>>>> ... I argue that password cracking frameworks should start to
>>>>> incorporate searching for partial matches of hashes -- vanity hashes,
>>>>> partial collisions, hashes that mask specific masks, etc.
>>>>>
>
>
> That's why I titled the post "more than just vanity." :) I believe
> that there are other uses. Partial hash matches are currently being
> used in multiple previous and current CTFs. I believe that this is
> because partial hash matches have real-world value, some of which may
> not yet be readily apparent.
>
Hi,
Another use case is finding hash that looks almost exactly like some
other hash (to trick human brain). This technique was used in MITM
attack on ssh. It's called Fuzzy Fingerprints. You could read more about
it here:
http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.456.8211&rep=rep1&type=pdf
If it was possible to generate RSA or DSA key with fingerprint similar
to fingerprint of some other key, it should be easier to find plain-text
with hash similar to some other hash.
Best Regards
--
Marek Wrzosek
marek.wrzosek@...il.com
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
