[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <87h7ezyo3u.fsf@d>
Date: Sun, 05 Sep 2021 19:38:13 +0300
From: Aleksey Cherepanov <aleksey.4erepanov@...il.com>
To: john-dev@...ts.openwall.com
Subject: Re: precomputed attacks for john: rainbow tables and other ways
Matt Weir <cweir@...edu> writes:
> What factors are you trying to optimize? Precomputation techniques are all
> about trade-offs so I’d be interested in hearing more about your use-case.
>
> Most of the places I see rainbow tables used is when you need to crack an
> individual unsalted hash in minutes, and you don’t have the hardware to
> back up a GPU cracking session to accomplish that reliably.
My main use-case is a hash cracking competition like CMIYC, where time
is limited to 48 hours so "preparing" "computations" seems lucrative. I
am aware that regular rainbow tables are not for massive cracking and
should be used after regular cracking. So possible uses are such:
- cracking random hash to discover a new pattern to improve cracking,
- cracking a few last hashes to complete some set (e.g. descrypt),
- maybe just cracking bigger amount of remaining hashes with ability to
say reliably that the attack is completed.
descrypt is an interesting target because its keyspace is on border of
what could be computed in a year. It is salted, but there are only 4096
different salts. So either separate tables could be prepared, or just
one table for a random salt would be ok to be able to crack a few hashes
to uncover missing patterns.
For a few descrypt hashes I might want to prepare a RT like full 7-bit
byte x 5 positions, so I would be able to run it and say: ok, remaining
passwords are longer than 5 chars and I don't miss utf-8 in short
passwords.
I postponed ideas about RT for smaller/smarter prepared attacks because
just preparing regular attacks would give practical results. And RT
would be a step _after_ preparing them.
Thanks!
--
Regards,
Aleksey Cherepanov
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
