[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <011001cd58b6$0bb55de0$232019a0$@net>
Date: Mon, 2 Jul 2012 19:51:55 -0500
From: "jfoug" <jfoug@....net>
To: <john-dev@...ts.openwall.com>
Subject: RE: Updates to the dynamic format (bleeding patch)
This change exposed a long standing bug (but trivial fix). Once this patch
was applied, selecting a single format, 'past' the dyna-7 was returning the
wrong format structure. I have a patch off to magnum, so I would imagine it
is in bleeding, or will be shortly.
Jim.
From: jfoug [mailto:jfoug@....net]
Sent: Monday, July 02, 2012 5:22 PM
To: john-dev@...ts.openwall.com
Subject: [john-dev] Updates to the dynamic format (bleeding patch)
Here are the changes:
Made a new format bit (FMT_DYNAMIC)
--list=format-all-details lists this flag, as a 'dynamic' format. Also if a
dynamic format, --list=format-all-details gets the proper salt size from the
format. The dynamic formats will always have a salt_size of 0 or the size
of a pointer in the fmt_main structure. They handle their own salt
processing, since it is variable. Also the format handles all duplicate salt
stuff, by keeping a list of all pointers, and if a dupe is found, the
original pointer is returned again.
Dyna_7 has been fully deprecated (commented out, with comments in the source
as to why). Dyna_6 is the format to use.
The length of pw inputs, and salts have been audited.
Bug fixed in the parser (a calloc should have been used, vs an alloc).
2 new parser keywords added: SaltLenX86= and MaxInputLenX86= These are
fully optional, and rarely needed.
The length of data for SSE types is 55, and the length for data for non-see
builds is 80. The length of salt/pw (and an optional saltx86/pwx86) now
sets these values up. This can be done automatically, by simply setting the
salt length. It can also be overrode by the format builder. A format like
md5($s.md5($p)) will have to have the salt limited to at most 23 bytes (for
SSE), due to 32 bytes from the hash. However, in this case, there is no
reason to limit the length of the PW to 32. It can be set to 55, even though
55-23 is 32. If for this format, the salt (ITW) was 32 bytes, then this
format would need to be re-engineered, and must not use SSE for the outer
md5().
I know Frank raised issues with the length's, but the complexities are NOT
easy to work around. Also, there is, and will never be, any length
validation checking within the inner workings of the format. The format
author must know the layout of memory. There really is no other way around
it, UNLESS they want to simply make the format Not-SSE-Safe.
Added a function in dynamic to return the 'real' salt length (since this was
not exposed globally).
Jim.
Content of type "text/html" skipped
Download attachment "JtR-dynamic-single-format-busted.diff" of type "application/octet-stream" (821 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
