[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20100113205848.GA8588@openwall.com>
Date: Wed, 13 Jan 2010 23:58:48 +0300
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: getting started, unix_crypt hashes
On Wed, Jan 13, 2010 at 08:49:55PM +0100, SL wrote:
> Am 2010-01-13 um 19:49 schrieb Paul Needham:
> >time: 0:00:00:09 - I expect this is how long the attempted crack
> >has been running for?
> * I don't know for sure, but I believe this is CPU time, not real time.
Actually, this is real time.
> >c/s: 489829 - ?
> * John is trying 489,829 password candidates per second on your
> machine (for "Traditional DES" hashes).
No, with multiple hashes being cracked, the rate of password candidates
per second is lower than the reported c/s rate, which corresponds to
combinations of {target hash, candidate password} per second.
> So, yes, "Traditional DES" passwords are limited to 8 characters,
Correct.
> longer candidates are either truncated or rejected (I don't know
> which it is).
It's tricky. Some of those that would result in effective duplicates
are rejected (ideally all of them would be), the rest are truncated.
Additionally, the same code supports "bigcrypt" hashes, which support
passwords longer than 8 but are split on load "at length 8". JtR tests
candidate passwords of lengths up to 8 against halves of such hashes,
and it combines them "back" on "--show". This is similar to the way it
works with LM hashes.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
