[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20150816141629.GA21321@openwall.com>
Date: Sun, 16 Aug 2015 17:16:29 +0300
From: Solar Designer <solar@...nwall.com>
To: john-dev@...ts.openwall.com
Subject: Re: testing every index (Re: more robustness)
Kai,
On Sun, Aug 16, 2015 at 09:04:26AM +0800, Kai Zhao wrote:
> On Sun, Aug 16, 2015 at 12:33 AM, Solar Designer <solar@...nwall.com> wrote:
> > Have you since implemented testing of every index (in the range of 0 to
> > max_keys_per_crypt) when running with --test-full? Where is it in code?
> >
> > I recall us finding one bug in this way, but I don't see it in code.
>
> Yes, we did. The code is in formats.c:: 1196~1211
> First, set (max - 1) keys by longcand, then set the last keys which is the
> right key.
That's not what I had meant. It's not testing every index - it's
testing the last index only, and only with a correct password in it.
Looks like nothing has been done on the original task, and you have yet
to take care of it.
We need to test that in every index a correct password is detected as
such, and an incorrect password is detected as such as well. To speed
this up and to mimic actual cracking, you should set and test passwords
in all indices at once. In order to test every index in both ways, you
will need to invoke crypt_all() at least twice. If you do it exactly
twice, then you need to invert the selection of which indices hold
correct vs. incorrect passwords between the two crypt_all() calls.
Will you implement this soon, please?
Thanks,
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
