[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <BLU0-SMTP2003668F3225CFB235EC6DDFD550@phx.gbl>
Date: Tue, 20 Nov 2012 06:27:27 +0100
From: Frank Dittrich <frank_dittrich@...mail.com>
To: john-users@...ts.openwall.com
Subject: Re: How does incremental mode works?
On 11/19/2012 11:52 PM, Richard Miles wrote:
> 2) Suppose that I will generate a dictionary following my password policy
> enforcement, for example:
>
> - All passwords must be at least 6 chars long.
> - At least 1 number.
> - At least one capital letter.
>
> And I will use this dictionary to generate a stats file and I also define
> that under Markov configuration no passwords with 6 chars should be
> generated / tested.
>
> My question is, all candidates generated by Markov on this conditions will
> always contains at least 1 number and 1 capital letter?
No, of course they won't. Markov mode takes into account frequency
information about up to 2 characters. So, when possible candidates for
the 5ths character are calculated, it considers probability of different
characters following the character that has been used as the 4th
character (plus the markov level reached when adding the 5th character).
Whether or not any of the previous characters has been a digit or an
upper case letter doesn't matter.
On the other hand, you might end up with lots of passwords adding a
digit at position 2 or 3, while most of your real passwords which were
used to generate the stats file only contained digits at the begin or at
the end of the password.
This is because Markov mode, unlike incremental mode, doesn't use
frequency information based on the current offset or on word length.
Frank
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
