[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CANWtx03oc52udTCwt8QT9rAy24-9TH6d10Pty9gkdGzC_M+uHQ@mail.gmail.com>
Date: Tue, 8 Apr 2014 10:14:40 -0400
From: Rich Rumble <richrumble@...il.com>
To: john-users@...ts.openwall.com
Subject: Re: Secure Mode for John
On Sun, Mar 2, 2014 at 8:51 PM, Mark Butler <markb@....ibm.com> wrote:
> > A first try is now committed to bleeding-jumbo. Enable by setting
> > SecureMode=Y in john.conf.
>
I like this mode, however, what could be done about sharing the hashes when
you have to distribute, but you do not want the hashes to work if this JtR
mode isn't enabled?
This would require a bit of effort, and I'm just spit-balling, but could
GPG be used to encrypt the hashes I want to distribute, and be decrypted in
memory (using some --pub-key option) so that they can then be tried in JtR?
Could the same public key be used to encrypt the cracked hashes, so that
the original private key can then decrypt them if need be?
I know all this adds cycles and takes resources away from the cracking, but
it's a mode I'd be interested in using. I think it would could be a more
responsible method of full-disclosure where you ask for public
participation. I have no illusions that a further modified version of JtR
or someone using a debugger etc would be unable to get the decrypted
hashes from memory (or write them to disk/pagefile etc).
There may not be a need/want for it, or it's going overboard, but I thought
I'd put the idea out there.
./john passes.txt --pub-key=pubkey.gpg --pot=secure.pot
-rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
