[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20090613094025.GA4056@openwall.com>
Date: Sat, 13 Jun 2009 13:40:25 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: cracking MD5 hashes more than 8 characters long with a dictionary
On Sat, Jun 13, 2009 at 11:22:35AM +0300, Antonios F. Atlasis wrote:
> checking (counting) the precise length of these passwords, this is
> exactly 16 characters. Hence, I suppose this is due to the limitation
> that you mentioned concerning the MD5, right?
That's correct. Only passwords of up to 15 characters long (inclusive)
will be cracked by current versions of JtR when you're dealing with the
MD5-based crypt hashes.
> A limitation that
> obviously does not exist in Blowfish implementation, I guess.
Correct.
> Is there any work-around on this?
No, the existing MD5-based crypt code is fundamentally limited in this
way. Computing hashes of this type of passwords of 16 characters or
more would require more code (or different code) and would be roughly
twice slower. Most of the time, checking twice more candidate passwords
of lengths up to 15 is preferable over checking some candidate passwords
of length 16 and above, because shorter passwords are usually also the
weaker ones (exceptions do exist, though).
Alexander
P.S. When you reply to a posting on this list, please be careful to
quote relevant context only, like I did above. Please do not over-quote.
--
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
