[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 28 May 2019 08:53:58 -0500
From: jfoug <jfoug.openwall@....net>
To: john-users@...ts.openwall.com
Subject: Re: SSHA256 (32bit hash, 32bit salt)
>> I think the issue is the salt is 32bit.
> It's actually 32 bytes, or 256-bit.
>
> What kind of system did this hash come from? Should we add better
> support for it to JtR, so that the re-encoding would be unnecessary?
>
> I notice we have support for hashes tagged {SSHA} and {SSHA512}, but
> currently not for {SSHA256}.
>
> Alexander
If we were looking at using dyn-62 for this, the way (ATM) to do this is
to create a thin format. What a thin format does is somewhat like
overloading within C++. It takes dynamic as the 'base' class, and then
overrides a few functions. Usually, valid() and prepare() are the main
overloads required. All of the other format methods point to the
'normal' dynamic methods. So when john reads the input file, it sees
the {SHA256}base64 signature and valid says it knows this one. Then the
prepare will perform the conversion just like Solar showed in his perl
script, but that conversion is done automatically. Then dynamic simply
'works', because it knows how to do SHA256($p.$s) using dyna-62 script.
This could easily also be done with a 'thick' normal format (not using
dynamic).
However, if this is not going to be a common format (say it was used
specifically by one company and will not really be ITW), then building a
thin format may not really make sense.
The problems 'assuming' that {SSHA256} will always mean the same thing
can be a crap shoot. Unless it was used (and then having the hash
format 'documented'), it could be {SSHA256}base64(pass.hash)
{SSHA256}base64(pass).base64(salt) {SSHA256}base64(salt.hash) , etc,
etc. Or even use the salt literally, or be in hex, or use some other
bizzare base64 encoding like the 'crypt*' encodings do.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
