[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20150806182804.GA22797@openwall.com>
Date: Thu, 6 Aug 2015 21:28:04 +0300
From: Solar Designer <solar@...nwall.com>
To: john-dev@...ts.openwall.com
Subject: Re: auditing our use of FMT_* flags (was: more robustness)
On Tue, Aug 04, 2015 at 08:57:29AM +0800, Kai Zhao wrote:
> 2. FMT_CASE
>
> 2.1 formats have not set FMT_CASE but there is at least one
> password which is case-sensitive
>
> LM, WoWSRP, mssql, nethalflm, netlm, oracle, sapb, saph
For LM, I have explained the situation here:
http://www.openwall.com/lists/john-dev/2015/08/06/14
You need to enhance your test. For nethalflm and netlm, it's probably
the same thing.
For the rest, I'd like others to comment. (I think some of these
formats got fixes committed already.)
> 2.2 formats have set FMT_CASE but all passwords are
> case-insensitive
>
> OpenVMS
In uaf_encode.c: uaf_test_password() we have:
if ( pwd->flags & UAI$M_PWDMIX ) { /* take password verbatim */
password_dx.dsc$a_pointer = (char *) password;
} else {
/*
* Upcase password.
*/
password_dx.dsc$a_pointer = uc_password;
if ( password_dx.dsc$w_length > sizeof(uc_password) )
password_dx.dsc$w_length = sizeof(uc_password);
for ( i = 0; i < password_dx.dsc$w_length; i++ )
uc_password[i] = toupper ( ARCH_INDEX(password[i]) );
}
So it's not that simple. Can you try to come up with and add test
vectors that would exercise the "else" code path?
Kai, you'll need to keep track of these issues, and perhaps post a
summary of the remaining ones a week later. Thanks!
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
