[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20130608070609.XLY7Y.556303.imail@eastrmwml108>
Date: Sat, 8 Jun 2013 7:06:09 -0400
From: <jfoug@....net>
To: john-dev@...ts.openwall.com
Subject: Re: limits within mscash2
---- Frank Dittrich <frank_dittrich@...mail.com> wrote:
> On 06/08/2013 10:33 AM, jfoug@....net wrote:
> > I am not sure why we have user name length and password length limits within the mscash2 format? I plan to remove them, but at first, only on the CPU format.
>
> Do we know what the real limits are?
I went digging, and the best I could find was user name was 128 byte limited. Older NT limited it to 20 characters (actually sounds like user names were truncated to this length), but I do not think any OS past Nt4 would do this, UNLESS there was group policies setup to keep the older ActiveDirectory naming sizes (like the group policy to keep the LM format even in Vista for compatibility). The 20 character name truncation sounds like it was an AD limit.
I think PW length is also 128 bytes (possibly 256). JtR has a 125 byte cap, so that is where i coded mscash2 to handle..
>Otherwise just getting rid of these
> limits is probably a good idea.
> May be the maximum salt length is smaller than the maximum user name
> length, and the salt gets cut at the max. length? How to verify this?
> If we find out the real user name / salt length and password length
> limits, these should be documented somewhere.
> Can we generate some real mscahs2 hashes for very long user names and
> passwords and include these for --test.
This would be good information to 'know'. However, it may be that it is OS dependent, or specific policy dependent. But you are right, if we CAN find this information out, at least we can document what we know.
CPU format is 'done' with longer creds. It handles 128 byte user names, and 125 byte passwords. There is a 'max sized' hash in the self test right now. The OpenCL has been changed for longer password. The longer salt will take a little more looking into. This is the first GPU modification I have done, so I am going slow.
Jim.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
