[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CANnLRdiQJCjoC==cvQiMcpHSz3oDW72thAkFmkKttVjcYDscDQ@mail.gmail.com>
Date: Fri, 8 Feb 2013 18:00:53 -0700
From: Stephen John Smoogen <smooge@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: SSHA-512 supported?
On 8 February 2013 17:56, Jon Schipp <jonschipp@...il.com> wrote:
> On Fri, Feb 8, 2013 at 7:39 PM, Solar Designer <solar@...nwall.com> wrote:
>> On Fri, Feb 08, 2013 at 07:35:22PM -0500, Jon Schipp wrote:
>>> In case this helps, from pwdalg.cfg
>>>
>>>
>>> "cost_num=cost
>>> *
>>> * The default hashing iterations is 2^cost. The valid value of cost is
>>> * an integer between 4 and 31, inclusive. The default cost value is 6."
>>
>> Isn't this written in context of bcrypt hashes (which they call sblowfish)?
>> If so, we knew that, but it's irrelevant.
>
> Lines further down in the config describe the blowfish count:
> "The default hashing iterations is 2^cost. The valid value of cost is
> an integer between 4 and 31, inclusive. The default cost value is 8."
>
> A default of 8 instead of 6 previously mentioned. Again, I don't know
> if that is helpful or not.
>
>> Do you suspect they were dumb enough to apply the same low iteration
>> counts for sha512crypt, where each iteration is a lot cheaper? Well,
>> maybe. Got to test the 1 to 999 range.
>
> I'm curious and not a programmer, what do you mean by "where each
> iteration is a lot cheaper"? How are they cheaper?
Ok so if this is basically saying how many times you are going to run
through your hash to get an answer.
4 = 2^4 = 32
6 = 2^6 = 64
8 = 2^8 = 256
so less rounds means the CPU is doing less work and thus it is
cheaper. You want to have LOTS of rounds if you want to hash something
that is expensive for a cracker.. so something like 10 as a minimum
(1000) versus 64.
> Thanks
> Jon
--
Stephen J Smoogen.
"Don't derail a useful feature for the 99% because you're not in it."
Linus Torvalds
"Years ago my mother used to say to me,... Elwood, you must be oh
so smart or oh so pleasant. Well, for years I was smart. I
recommend pleasant. You may quote me." —James Stewart as Elwood P. Dowd
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
