[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20061012190121.GA23326@openwall.com>
Date: Thu, 12 Oct 2006 23:01:21 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: Question about hashes
On Thu, Oct 12, 2006 at 03:14:35PM +0200, Guillaume Arcas wrote:
> My question may sound strange : what is the "faster-or-easier-to-crack-by-john"
> hash ?
LM hashes are probably the fastest, however they also have properties
that make password cracking even easier than it might be for your target
application and they might not be convenient for you to compute.
Raw MD5 hashes should work well for your intended purpose - they're
fast, saltless, easy to compute, and they have no unusual properties.
However, you would need to apply the contributed patch to JtR to enable
the support for these hashes.
> Here the stuff : I have some cleartext stored passwords (please don't ask me why
> or how, it's not my choice !) that I would like to audit using John. These
> passwords are stored in cleartext by a kind of Password Vault software. The
> thing is to audit these passwords automatically.
This topic was briefly raised on this mailing list before:
http://www.openwall.com/lists/john-users/2006/07/19/12
> What I do for now is create a Unix-like password file using Perl. I then can
> run JtR against the Unix hashes.
That's right.
> So I just wonder if there is a more easier or faster cracked hash format to
> choose so my audits run take less time.
Yes - please see above.
Also, you probably want to avoid the truncation at 8 characters that
occurs with the traditional DES-based crypt(3). Raw MD5 hashes don't
have this undesirable property.
--
Alexander Peslyak <solar at openwall.com>
GPG key ID: 5B341F15 fp: B3FB 63F4 D7A3 BCCC 6F6E FC55 A2FC 027C 5B34 1F15
http://www.openwall.com - bringing security into open computing environments
Was I helpful? Please give your feedback here: http://rate.affero.net/solar
--
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
