[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <BLU0-SMTP1997A4B15B1202909648110FD000@phx.gbl>
Date: Thu, 24 May 2012 20:16:37 +0200
From: Frank Dittrich <frank_dittrich@...mail.com>
To: john-users@...ts.openwall.com
Subject: Re: Can Excessive Rounds make Password cracking Infeasable
On 05/24/2012 08:06 PM, Brad Tilley wrote:
> This is slightly off-topic as it does not specifically relate to John use,
> but I wanted to ask the opinions of others here. When do rounds make
> password cracking infeasible, or do they? For example, the hash below is a
> SHA-512 hash with 391939 rounds applied. You can actually feel the delay
> at logon (about 2 seconds on newer machines):
>
> test:$6$rounds=391939$UqhsyLSZ$F/K1CGpBf9yefYXCRbY5uK/LW1HzW8EiPCzdq8PMVvZ4JLhb4F464ps87MX/YwYEI0s62KIsnZBuCt45a.A4I0:1002:1002::/home/test:/bin/sh
>
> The source code of sha512-crypt.c sets this as the maximum number of
> rounds so Linux sys admins could configure this number even higher:
>
> /* Maximum number of rounds. */
> #define ROUNDS_MAX 999999999
>
> So long as the passwords are sufficiently complex and users can't select
> simple words such as 'password' for their password, I would think that
> these hashes are close to un-crackable (certainly not in a reasonable time
> period anyway). What do other John users think?
The problem is, even a delay of 2 seconds during login might be
unacceptable.
If you don't have a single-user system, but a server that is used by
thousands of users who all login at nearly the same time, the possible
delay will be much longer, and the server will hardly be usable for
other activities during those times.
Frank
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
