[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <678686ef4332f23936ab6daa1b2b2f20@smtp.hushmail.com>
Date: Tue, 10 Sep 2013 20:40:11 +0200
From: magnum <john.magnum@...hmail.com>
To: john-dev@...ts.openwall.com
Subject: Re: mask mode bug
On 10 sep 2013, at 18:53, Sayantan Datta <std2048@...il.com> wrote:
> On Fri, Sep 6, 2013 at 12:18 AM, magnum <john.magnum@...hmail.com> wrote:
>> form=raw-md5-opencl guesses: 1323 0:00:00:02 DONE : Expected count(s) (1500) [!!!FAILED!!!]
>> .pot CHK:raw-md5-opencl guesses: 1116 0:00:00:02 DONE : Expected count(s) (1500) [!!!FAILED!!!]
>
> This issues is fixed on fx 8120, A4500M(CPU) and HD7670M. Please test it on 650M too.
Excellent, all issues I knew of is gone now *except* one little detail... Try this hash:
$ echo >nullhash nullstring:d41d8cd98f00b204e9800998ecf8427e
Like it says, it's a null string password. Mask mode shouldn't crack it at all and the CPU format doesn't:
$ rm -f test.pot && ../run/john nullhash -form:raw-md5 -pot:test.pot -mask=?A
Loaded 1 password hash (Raw-MD5 [MD5 128/128 AVX 12x])
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:00 0g/s 22400p/s 22400c/s 22400C/s ?..?
Session completed
...but your mask-mode OpenCL formats cracks it with a false positive:
$ rm -f test.pot && GWS=65536 ../run/john nullhash -form:raw-md5-opencl -pot:test.pot -mask=?A
Device 1: GeForce GT 650M
Local worksize (LWS) 64, global worksize (GWS) 65536
Loaded 1 password hash (Raw-MD5-opencl [MD5 OpenCL (inefficient, development use only)])
Using kernel md5_ccc...
Press 'q' or Ctrl-C to abort, almost any other key for status
? (nullstring)
1g 0:00:00:00 1.587g/s 1.587p/s 355.5c/s 355.5C/s ?..
Use the "--show" option to display all of the cracked passwords reliably
Session completed
That question mark is really the eight-bit character \x80:
$ LC_ALL=C cut -d: -f2 test.pot | hexdump -C
00000000 80 0a |..|
This only seem to happen with -mask=?A, not with eg. ?a or ?A?A. I have no idea if this false positive also means we have some other false negative somewhere, or not. But I tested ?A in lengths up to 4 and compared with CPU format and there seem to be no false negatives, and no other false positives.
cheers,
magnum
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
