[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20200504212437.GA2610@openwall.com>
Date: Mon, 4 May 2020 23:24:38 +0200
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: Is the example of HMAC-SHA512 right?
On Mon, May 04, 2020 at 11:33:47PM +0800, gyula wrote:
> Hello, I'm trying to crack a hash encryted by HMAC-SHA512.
You must mean "computed", not "encrypted". HMAC doesn't encrypt.
> I use the command, "john --list=--list=format-details |grep HMAC-SHA512", to search the example of it.
>
> The example hash is below.
>
> "what do ya want for nothing?#164b7a7bfcf819e2e395fbe73b56e0a387bd64222e831fd610270cd7ea2505549758bf75c05a994a6d034f65f8f0e6fdcaeab1a34d4a6b4b636e070a38bce737"
Yes, that's our first test vector for HMAC-SHA512. I vaguely recall
that it came from some password cracking contest.
> I don't konw the meaning of "what do ya want for nothing?#". The rest is the hex form of hash, I think.
> Moreover, I can't find the salt.
That cryptic string "what do ya want for nothing?#" is what we process
as salt in this example.
> When I crack it with John The Ripper, It cracked. The result is Jefe.
That's correct.
> I want to konw how to format a line with a hash from hmac-sha512 and a salt, then crack it.
The format is:
salt#hashinhex
Some unrequested detail:
BTW, as a special case, the salt may have a "#" embedded in it - that's
fine, we use the last occurrence of a "#" in the string as the delimiter
between salt and hash.
HMAC is defined as operating on key and data, not on password and salt,
and its direct uses for password hashing are actually misuses. The way
we support cracking of HMAC-* in JtR is treating password as key and
salt as data. This appears to match the demand so far, although it's
conceivable that the other order of these parameters would be used
somewhere and would need to be supported in JtR, which it unfortunately
is not.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
