mailing list archives
Re: TGP v184.108.40.206
From: "Thor (Hammer of God)" <Thor () hammerofgod com>
Date: Wed, 23 Jun 2010 15:35:58 +0000
Took me a second to know what you were saying - I was already replying that I *did* go through the required space. But
I think you are right - in the algorithm I'm using, I "stop" at the character in each column since I know what it is.
If I read you correctly, your saying that it would only matter on the most significant column, right? IOW, just
because I put an "a" in columns 12,11,10,9, and 8, to get to the "a" in column 13, I'd have to go through ZZZZZ in
those columns first, which I DON'T think I'm doing.
Yes, I think you are right - I must have been mixing post-Rainbow Table matching with brute force iterations. Oh well.
Looks like I've got some more coding to do tonight, assuming I understand what you are saying...
From: John Lightfoot [mailto:jlightfoot () gmail com]
Sent: Wednesday, June 23, 2010 8:25 AM
To: Thor (Hammer of God); full-disclosure () lists grok org uk
Subject: RE: [Full-disclosure] TGP v220.127.116.11
This looks great, but I have a question about your "how long would it take to crack *this* password" analysis on your
web site. In your example, you choose aaaaaaNotGood, a 13 character mixed case password, and said it could be cracked
in 44 days. But to crack a 13 digit mixed case password (knowing in advance it was mixed case), wouldn't you have to
enumerate through the entire 12 digit and smaller keyspaces before you get to the 13 digit keyspace?
So you'd have to go through 52^1+52^2+...+52^12 before starting on the 13 digit keyspace, which would take much longer
than 44 days. It would only be 44 days if you knew both the keyspace and the length.
From: full-disclosure-bounces () lists grok org uk [mailto:full-disclosure-bounces () lists grok org uk] On Behalf Of
Thor (Hammer of God)
Sent: Wednesday, June 23, 2010 2:25 AM
To: full-disclosure () lists grok org uk
Subject: [Full-disclosure] TGP v18.104.22.168
I've made some major revisions to TGP over that last couple of weeks, and am releasing v22.214.171.124:
It's on the main site now and I've moved all the pilot stuff over to the HoG production site.
Notably, there is support for key creation to 16384 bits, which pretty much also required for me to build
multi-threading capabilities in so that you could go do other stuff while processing huge keys if you wanted to.
Also, based on some dialog on FD where some folks didn't quite get the math behind creating large keys and protecting
keys with long and complex passphrases, I added a feature where I calculate the actual time required to crack your
password keyspace based on Class F cracking speeds of 1,000,000,000 passwords per second. I've always been
less-than-thrilled with methods of determining how strong a particular password was because "strong" doesn't mean
anything by itself. "Complex" means something insofar as structure is concerned, but it doesn't translate into
real-world applications: Upper, Lower, and Digit for instance doesn't mean much to a person - so I actually calculate
out the time it takes based on the keyspace used in your password as you type it in so that you can see right then that
it may only take 1 year/day/minute to crack your password.
Further, something I've not seen anywhere else is an actual measurement of what it will take to crack YOUR password as
you type it, not just the keyspace. To brute force up to a two character lower case alpha passphrase's keyspace will
take 702 iterations (not 676 like most people will tell you since it's only 676 if you start at "aa"). However, if you
actually typed in "jx" as your password, that would crack in only 284 iterations. So I also built in the calculation
for what your actual password will crack in as well, not just the keyspace. Of course, there are some assumptions I
must make about base keyspace which are explained on the website if anyone cares to read it. There's a bunch of other
things listed as well if you would like to check it out.
Next thing on the list is to move from memorystreams to parallel processing in smaller blocks so that I'm not dependent
on machine memory to encrypt really big files. I'll set up a mailing list at some point for people who would like
[Description: Description: Description: TimSig]
Timothy "Thor" Mullen
Hammer of God
thor () hammerofgod com<mailto:thor () hammerofgod com>
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- TGP v126.96.36.199 Thor (Hammer of God) (Jun 23)
- Re: TGP v188.8.131.52 John Lightfoot (Jun 23)
- Re: TGP v184.108.40.206 Thor (Hammer of God) (Jun 23)
- Message not available
- Message not available