[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20120916231158.GA12456@openwall.com>
Date: Mon, 17 Sep 2012 03:11:58 +0400
From: Solar Designer <solar@...nwall.com>
To: john-dev@...ts.openwall.com
Subject: Re: "single crack" missing candidates (was: Office2john)
On Sat, Sep 15, 2012 at 11:11:40AM +0200, magnum wrote:
> Bumping LDR_WORDS_MAX from 0x10 to 0x20 fixes the problem in this case. Maybe because the correct password is just part of the username (delimited by underscores), not all of it?
Yes, this must be the case. Here's what ldr_init_words() does:
if (*login && login != no_username)
list_add(words, login);
ldr_split_string(words, gecos);
if (login != no_username)
ldr_split_string(words, login);
if ((pos = strrchr(home, '/')) && pos[1])
list_add_unique(words, pos + 1);
Notice how ldr_split_string() on login is only called after it's been
called on GECOS.
> Could we bump this value? We have an experimental version of office2john that rips things like Title, Subject, Author, Last Saved By, Template and Keywords from the document (these are readable even though the doc is encrypted) - and put into the GECOS field for use bu Single mode. Often, we get plenty of words so I think we might want to bump it to 0x40 or more, if it doesn't cause problems.
LDR_WORDS_MAX and SINGLE_WORDS_PAIR_MAX are meant to prevent some
password file lines from taking disproportionally more CPU time than
others. Also, list_add_unique() uses linear search under assumption
that the list is tiny.
That said, yes, I think that bumping LDR_WORDS_MAX and
SINGLE_WORDS_PAIR_MAX makes sense - maybe from the current 0x10 and 4 to
60 and 6. So we'll use up to 60 individual words and up to 5*2*6 = 60
word pair based strings (built from the first 6 words only).
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
