[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 1 Jun 2023 23:14:41 +0000
From: Thomas Ward <teward@...mas-ward.net>
To: "john-users@...ts.openwall.com" <john-users@...ts.openwall.com>
Subject: RE: "No hashes found" when argon2id is present?
Glad to hear that.
I will also make the following observations (for all uses of john): it LOOKS like more recent phpBB variants are using argon2id instead of standard salted-sha hashes, which in turn means that when someone is attempting to brute force hashes for the purposes of pentesting or otherwise in any kind of phpBB forums of recent vintage, it will not be possible to use JtR for this until the argon functionality is updated, which *generally* increases the priority for this being updated as well, if someone's using JtR with wordlist and the mangling rules to bruteforce.
Thomas
-----Original Message-----
From: Solar Designer <solar@...nwall.com>
Sent: Thursday, June 1, 2023 3:17 PM
To: john-users@...ts.openwall.com
Subject: Re: [john-users] "No hashes found" when argon2id is present?
On Thu, Jun 01, 2023 at 07:02:48PM +0000, Thomas Ward wrote:
> That's a pretty old bug, any timeline on OpenWall's side as to when you'll actually *update* implementation? When trying to run a breach simulation on a set of password hashes I have which I'm doing white-hat hacking stuff on, the hashes are all argon2id and not having this in John is problematic - using other tools exhaust >= 32GB of memory, which causes issues with attempting to crack it.
I wouldn't call it a bug - it's an issue, and a missing desirable feature. I agree it's been hanging around for way too long, given it's fairly important. We do not have specific timelines for any JtR development tasks, however we assign some to milestones - this one is currently tracked among tasks that we intend to take care of before we make the next release. There's no timeline for that release, though.
You letting us know that you require this functionality is a reason for us to prioritize it. Thank you for that.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
