[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20110119230236.GA24814@openwall.com>
Date: Thu, 20 Jan 2011 02:02:36 +0300
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: Plain Text/No-op Password Format
On Wed, Jan 19, 2011 at 03:40:44PM -0700, RB wrote:
> On Wed, Jan 19, 2011 at 15:23, Solar Designer <solar@...nwall.com> wrote:
> > 3. "$plain$" followed by plaintext password with any colons escaped as
> > "\c" and any backslashes escaped as "\\". Maybe also support "\n" and
> > "\r" escapes for LF/CR chars embedded in passwords.
>
> My vote would sit here, simply because escapes can be
> processed/generated with simple, common tools like sed.
Thanks. Actually, hex-encoding is as easy to generate with a Perl
one-liner (OK, not with sed). When you process/generate backslash
escapes with sed, it may be too easy to inadvertently get this wrong
because the shell and sed also use backslash as an escape character.
I forgot another option:
4. URL-like %-encoding. That is, always encode chars that need encoding
(only the percent and the colon characters), but optionally encode any
other characters as well. Maybe this brings us the best of both worlds
because it lets us use either the substitution approach (just substitute
the two "bad" characters) or the encode-all approach. It also allows
for embedded and encoded linefeeds and terminal control characters. The
prefix could be "$plain$" or maybe "$percent$" or even "$%$".
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
