[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <BLU0-SMTP3547BE17A71AB4466635C17FD390@phx.gbl>
Date: Sun, 15 Apr 2012 07:39:24 +0200
From: Frank Dittrich <frank_dittrich@...mail.com>
To: john-dev@...ts.openwall.com
CC: john-users@...ts.openwall.com
Subject: maximum password length (was: fast hashes on GPU)
Hi Alexander,
I'll CC john-users, because at least some parts of my mail are probably
relevant on that list too.
On 04/15/2012 02:59 AM, Solar Designer wrote:
> Lion's actual maximum password length is probably different - can be
> lower or higher than 107. It might even vary by the method used to set
> the password (such as GUI vs. CLI).
May be someone on john-dev or john-users could check this out.
The real maximum password length should be documented somewhere.
Either as a comment in the code, or on a wiki page, or both.
We should also collect this information for any other hash type, so that
we at least know the maximum password length when the password length
supported by john's (highly optimized for speed) implementation is lower.
In certain circumstances it might be needed to implement a less optimal
algorithm (may be q&d and ad hoc), to try a few passwords that are
longer that the limited length of the tuned algorithm.
OTOH, if we really know the actual maximum password length for a format,
we probably shouldn't support trying longer password candidates.
If there cannot be such passwords in the wild, allowing to test such
invalid passwords would just waste time.
If we reduce the supported maximum password length to the actual length,
we could document the maximum password length which would not impact
performance somewhere in the code, e.g. a comment close to the
maximum password length definition.
Just in case that in future the maximum password length actually used
somewhere in the wild increases, we could easily adjust that length in
the code. (But after reducing the maximum supported password length, bit
rot or further code optimization might make switching back to the older
maximum password length more difficult.)
Frank
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
