john-users - using john to decrypt DES hashes

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20221013091859.GA9@sh4-5.1blu.de>
Date: Thu, 13 Oct 2022 11:18:59 +0200
From: Matthias Apitz <guru@...xarea.de>
To: john-users@...ts.openwall.com
Subject: using john to decrypt DES hashes

Hello,

Me and my company are managing large databases wherein the PIN of users
are hashed with UNIX crypt(3) in the old DES form and a fixed salt "xX".
With large I mean some thousands. For data security reasons we want to
move to a better algorithm, "yescrypt", and when the user provides the
PIN in clear, it is checked against the old DES hash, and when correct
the field in the database is updated to "yescrypt" by our software. So
far so good. I also want to update the (remaining) old hashes to "yescrypt"
before some hacker is using them, if he got access to the DES strings.

I compiled john from source (john-1.9.0-jumbo-1.tar.xz) and
investigating it a bit. I prepared an ASCII file with ~4000 lines like

xxxxxxxxxxx:xXEBkhHX.M44s
xxxxxxxxxxx:xXU1M01DhRvks
zzzzzzzzzzz:xXuZorViKW9Gk
...

and run it with 'john pins.des'

This works fine and I can watch the results with

$ john --show pins.des
...
xxxxxxxxxxx:301193
yyyyyyyyyyy:tauchen1
zzzzzzzzzzz:070295

$ john --show d02-des.pins | wc -l
    3710

My questions are:

1) 
As the salt is fixed and known as "xX" can this provided somehow to john
to speed up the things?

2)
I saw the files below ~/.john and understand what they contain. But,
even if I remove everything there and restart 'john pins.des', it knows
somehow the already cracked PINs , some 3700 and starts working on the
remaining 276, very slowly. One PIN in ~5 minutes. How this is managed,
i.e. where the 3700 are stored?

Thanks

	matthias

-- 
Matthias Apitz, ✉ guru@...xarea.de, http://www.unixarea.de/ +49-176-38902045
Public GnuPG key: http://www.unixarea.de/key.pub

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.