[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <BLU0-SMTP364A7AC6B3C45B4F9516955FD150@phx.gbl>
Date: Wed, 23 Jan 2013 16:17:05 +0100
From: Frank Dittrich <frank_dittrich@...mail.com>
To: john-dev@...ts.openwall.com
Subject: Re: Min password length
On 01/23/2013 02:45 PM, jfoug@....net wrote:
> What about formats which have a min password length? Do we have a mechanism to tell JtR to not try any words that are shorter than X bytes long? I know we have external filters to force this, but that is not the question. Do we have a way to automatically do this?
>
> There are algorithms that specify minimal, so trying words less than the min length is a total waste of resources.
What formats are affected?
Do you know for sure that older versions of the OS or application didn't
allow shorter passwords?
Is the policy only checked when a new password is created by a user? Or
also when an admin sets the password for a user.
What if someone manages to directly change an existing hash?
(Is the password policy also enforced during login?)
I know of sapG (which should have been named sapF instead). Minimum
password length is 3. But the password policy is not checked during login.
So, if there is a user "F" and you change the hash to
"646A0AD270DF651065669A45D171EDD62DFE39A1", the user can still logon
with password "X". (The same is true for user "MAN", hash
"22886450D0AB90FDA7F91C4F3DD5619175B372EA" and password "u".)
For sapB, the minimum password length is 1.
(User "F" picked password "x Y". The system computes the CODVN F
or CODVN I hash for this password. Depending on release and system
configuration, the system also computes and stores the CODVN B hash
(replacing non-ASCII characters in the password with '^', truncating the
password to 8 characters, translating it to upper case, removing
trailing spaces.)
You cannot have an empty password. You wouldn't be able to login without
specifying a password.
SAP passwords have other limitations. E.g., the first character cannot
be '!' or '?'.
Frank
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
