[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20051015190200.GB1017@openwall.com>
Date: Sat, 15 Oct 2005 23:02:01 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: restricting john to eight character passwords
On Thu, Oct 13, 2005 at 01:28:46PM -0400, joe haldon wrote:
> On a solaris box recently the /etc/default/passwd file had a setting
> PASSLENGTH option to 8. Standard DES. Still it took a long time and was
> wondering if it would speed things up significantly to restrict the search
> to 8. Does that make better sense?
Yes, it does.
However, most of the time password policies like that are not strictly
enforced. There may be ways to set a password bypassing this check in
the system (e.g., would this restriction apply to passwords set by root?
would it apply to expired ones forcibly changed upon login?), so not
checking for shorter passwords with John might not be wise.
Also, your mentioning "Standard DES" suggests that you're using John 1.6
rather than the newer development versions (which would call the same
thing "Traditional DES"). The development versions are much faster at
DES, so you can simply use those to speed things up.
> Maybe the other option is to only have
> eight char words in the dictionary file?
No. The word mangling rules alter lengths, and wordlist-based cracking
is generally quite fast anyway. It is "incremental" mode which you
should care about the most. To set password lengths for that, edit the
MinLen and/or MaxLen settings in the appropriate [Incremental:...]
section in john.conf (or john.ini).
If you really want to not be trying candidate passwords shorter than 8
characters that are produced during wordlist-based cracking, you can
achieve that by suffixing each non-comment line in [List.Rules:Wordlist]
with ">7" (without the quotes).
> Anyway thanks for creating an awesome program.
You're welcome.
--
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598 fp: 6429 0D7E F130 C13E C929 6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments
Was I helpful? Please give your feedback here: http://rate.affero.net/solar
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
