[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <50A8BBF4.7050902@gmail.com>
Date: Sun, 18 Nov 2012 11:44:04 +0100
From: buawig <buawig@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: cracking passwords with a kerberos traffic dump
[implementation confirmed to work]
>>> As in standard Kerberos? It would surprise me a whole lot if
>>> Microsoft do not use the Unicode version of the password, or (even
>>> more likely) the 16 byte NT hash as input just like in mskrb5, as
>>> opposed to the plain string you use now.
>>
>> Ok, this makes it clear why I was not be able to crack it. So the
>> outcome will be a MS specific john format (mskrb5-18).
>
> I don't think that it is necessary to modify krb-ng_fmt_plug.c to
> support M$ AD specifically as M$ AD follows RFC.
Indeed it works, I was able to crack the known password* with you latest
krb-ng_fmt_plug.c!
So to not have to store the plaintext passwords the KDC stores the
per-user long term AES key generated from the password via PBKDF2, correct?
(I agree that this master key is equivalent to the password in the
kerberos world but in my opinion it is still better to store the AES key
as opposed to the actual password that was used to generate that AES key.)
> As I suspected, the problem turned out to be that the fast PBKDF2
> doesn't handle long passwords. I have switched back to safer but
> slower implementation of PBKDF2 and I can successfully crack
> M$ AD long passwords (> 16 chars).
To add some figures for how big the slowdown actually is on my side:
- 390 c/s (faster implementation with pw length limitation)
- 220 c/s (>16 password length support PBKDF2 implementation)
I'll keep the faster implementation too, as cracking something with that
speed and >16 pw length is not very likely anyway.
Thank you very much for the great work!
*) My Password properties: >16 chars long, including special symbols
(but still ASCII), no Unicode characters are present in the password.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
