[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <7891517ce49f05e71acb0a40440712c2@smtp.hushmail.com>
Date: Wed, 26 Feb 2014 02:22:31 +0100
From: magnum <john.magnum@...hmail.com>
To: john-users@...ts.openwall.com
Subject: Re: Secure Mode for John
On 2014-02-21 00:25, Mark Butler wrote:
>> Date: Tue, 21 Jun 2005 16:28:29 -0400
>> From: Jim Brown <jpb@...shooter.v6.thrupoint.net>
>>
>> I've used john in an enterprise environment as a strong
>> password compliance tool and I've had these concerns:
>>
>> 1. The passwords are visibly displayed.
>> 2. The .pot file contains password data that can be displayed
>> by running john at a later time.
>
> I would like to revisit the above. Ideally I would like a setting in
> john.conf to be able to turn on Secure Mode for john. I would envisage that
> when it is set, instead of john passing back the clear text password, it
> would pass back attributes of the password instead. Things like length,
> mode john is running in (Single crack [S], Wordlist [W], Incremental [I],
> External [E]) and the rule matched in that mode. eg: L8-W-R13 for a
> password 8 characters in length, cracked in Wordlist mode using rule 13.
> Hopefully all this information is available to john at the time the
> password is cracked.
A first try is now committed to bleeding-jumbo. Enable by setting
SecureMode=Y in john.conf.
It turned out to be a too intrusive patch writing stuff like modes &
rule numbers - and you can see such things in the log anyway. What it
does instead is showing what character classes are involved. Is that too
much information? For example, the password "Ignit3" would output as
L6-?l?d?u telling you that it's six characters long and consists of
lowercase, digits and uppercase characters. It does not hint about order
or amounts of each class. The classes are printed in mask-mode syntax:
?l ?u ?d ?s ?a for lower-case, upper-case, digits, specials and 8-bit.
> The flow on effect would be the .pot file would include the encrypted
> password with password attributes instead of the clear text password.
The current patch writes that same "L6-?l?d?u" string to log, pot file
and to screen. I can't see it go very wrong but everything I do is on a
best-effort basis so please test ;-)
Oh, and when this is activated, the default potfile is secure.pot so you
don't accidentally mix formats in john.pot. This can still be overridden
using --pot=FILE.
Review my patch here:
https://github.com/magnumripper/JohnTheRipper/commit/633a45f
Snapshot tarball:
https://github.com/magnumripper/JohnTheRipper/tarball/bleeding-jumbo
magnum
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
