[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <736d66420608311423w40f77374s22d23b4fec970cfc@mail.gmail.com>
Date: Thu, 31 Aug 2006 17:23:34 -0400
From: John <guipenguin@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: encryption strength vs. the time it takes to find the same password with different key sizes
OK, thanks, that makes sense.
Now one more question: I understand the basic principle behind taking a
dictionary work, or a string that JTR has created, encrypting that string,
and then matching it against an encrypted hash. Using that same encryption
algorithm, if the hashes match then that is your password.
But how does JTR do this with salted hashes? How does JTR figure out what
salt was used so that it can use this when encrypting the dictionary word
when you are trying to crack?
Thanks a ton.
On 8/31/06, Bolan, Scott <Scott.Bolan@...perdine.edu> wrote:
>
>
> John wrote
> -------------------------------------------------
> I am trying to better understand this, so please bare with me. Lets say
> I
> have two hashes I want to crack. Each hash uses the same password.
> If
> one encryption is with 32 bit. and the other is 64 bit. would cracking
> the
> 64 bit encryption actually take longer? Even though they both use the
> same
> length password? For example: I got thinking that if you used an
> lowercase
> alpha only password, that is 6 chars long.. so 26^6 possible combos to
> break
> it.... wouldn't it be the same for each encryption strength?
> -------------------------------------------------
>
> This is not quit what you were asking but it might be of interest.
>
> It is my understanding that *all* 32 bit hashes can be cracked. Here is
> the reasoning.
>
> - Since a hash has a finite length, multiple passwords will generate the
> same hash. (the pigeon hole principle: there are more possible
> passwords then there are hashes)
>
> - a 32 bit key has 2^32 possible hashes (4,294,967,296). A big number
> but on a reasonable computer this is 1 - 4 weeks of work.
>
> So instead of a 'naive' brute for attack, (a, b, c, ... , aa, ab, ac,
> ...), you can try all possible hashes. This will give you *a* correct
> password although it probably won't give the *the* correct password.
> You just need to find *a* password that hashes to the correct value
> (there are many).
>
> I suspect that the password you found would work for the 32 bit
> encryption but not for the 64 bit encryption. This is because you just
> found one of the passwords that worked for the 32 bit encryption and not
> the 'actual' password.
>
> Feel free to correct me if you think I am off my rocker.
>
>
> --
> To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
> to the automated confirmation request that will be sent to you.
>
>
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
