glv2 / bruteforce-luks

Try to find the password of a LUKS encrypted volume.
GNU General Public License v3.0
240 stars 34 forks source link

option to not try sequences of same character longer than a given length #13

Open illwieckz opened 7 years ago

illwieckz commented 7 years ago

A good option would be to skip any sequence of the same character when you know the passphrase is made from natural language. The length of same-char sequence must be optional, to adjust with the supposed language.

For example if the passphrase is based on the french sentence il m’a créée et m’a nommée using only [a-z] characters, you ended with ilmacreeeetmanommee. You will never find more than 4 e in a row in a french sentence, and that special form of the creer verb is the only french word with 3 vowel sequence and it only exists with the e vowel. As another example, there is no same-consonant-sequence longer than 2 inside a french word (like the verb battre, you can find two t in a row, never 3, and this form is always inside a word, never at beginning or end.

So, if we imagine a -n option for that, running bruteforce-luks -l 12 -m 12 -n 3 -s abehjkmr luks-header will try:

bejrramjehke
bjjtraajehke
bbjrraaaehkh

but not:

bejraaaaehke
baaaaaaaaaae
jaaaabbbbbbe
hhhhhkkkkkkk

If you know the passphrase is made from natural language with space-separated words or is written the CamelCase way, you can safely use -n 2.

Such option can safe time a lot to bruteforce man-made passphrase, and implementing this option will make the usage of same-character sequences in a passphrase a safe option. man-made passphrases tend to not repeat the same characters (imitating randomness) and this bias made them not truly random. If this option is implemented, the implementation can be used to prove repeating same characters in a passphrase can be safer than not repeating them.

bobpaw commented 5 years ago

If you're willing to use an external tool, there's always crunch.