[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <504B08DB.5040901@mccme.ru>
Date: Sat, 08 Sep 2012 12:59:07 +0400
From: Alexander Cherepanov <cherepan@...me.ru>
To: john-dev@...ts.openwall.com
Subject: Re: Formatting hashes
On 2012-09-08 09:44, Dhiru Kholia wrote:
> On Sat, Sep 8, 2012 at 4:23 AM, Alexander Cherepanov <cherepan@...me.ru> wrote:
>> Is including lengths into the hash really useful? Isn't it better to use
>> just $ between parts like this:
>
> I don't know if salt length is fixed (most likely it is).
It doesn't matter.
> Hence, I included salt length in the hash. I agree that 'entropy'
> length can be skipped.
Why do you need lengths at all?
Sure it's necessary to be able to parse a hash string and extract
different parts from it. For this, one can use separators between parts,
or lengths written before parts, or pointers to different parts, or
something. But you use both separators and lengths which IMHO is
excessive. Having only separators is enough.
Look at how other salted hashes are formatted. You have already posted
in this thread an example of this same hash formatted as
grub_pbkdf2_sha512 -- there are no lengths in it. Another similar
example is sha512crypt:
$6$rounds=5000$ojWH1AiTee9x1peC$QVEnTvRVlPRhcLQCk/HnHaZmlGAAjCfrAN0FtOsOnUk5K5Bn/9eLHHiRzrTzaIKjW9NTLNIBUCtNVOowWS2mN.
(example from cryptsha512_fmt_plug.c with "rounds=5000$" inserted). BTW
it's much shorter.
Or put it another way: right now you need to code parsing the length out
of a string, skip the separator after it (whether it's just scanf or
not), check for errors in the process and check that the length is not
excessive. After you know the length of the field you need to read that
much bytes from the string, check that that the string is not exhausted
in the process and that there is a separator after the field. Why
bother? Just read the string until you meet a separator (and check that
you didn't overfull the target buffer in the process).
Sometimes it's good to know the length in advance, say, to allocate
memory. But you operate mostly on fixed-length buffers in john. Are
there other reasons to get lengths in hash strings?
--
Alexander Cherepanov
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
