search

openwall / john

John the Ripper jumbo - advanced offline password cracker, which supports hundreds of hash and cipher types, and runs on many operating systems, CPUs, GPUs, and even some FPGAs
https://www.openwall.com/john/
Other
10.3k stars 2.1k forks source link

GPG-opencl's valid() too promiscuous, segfault #499

Closed magnumripper closed 9 years ago

magnumripper commented 10 years ago

The last two commented out test vectors should be rejected in valid() but are not. I don't understand why (see #482).

frank-dittrich commented 10 years ago

I didn't want to create a new issue for gpg's valid(), that's why just an addition to this issue:

Here's a test file that causes john to segfault:

$ ./john fail_gpg.pw 
Segmentation fault (core dumped)
$ cat fail_gpg.pw 
$gpg$*16*36*1024*0a4c2fb9d1ff24b817212a9cc0d3f2d84184a368ff3a04c337566812d037e5fe28933eaa*1*255*2*3*8*b312f3046fdb046c*0*a0ccc71dedfce4d3*128*f9235c132a796b0fd67f59567cf01dcf0a4ebbc8607a1033cefd2d52be40334e8cfba60737751b1bf16e36399340698656255917ca65f1f6f7806f05f686889ef7dc7030dd17dc9b45a1e1f01ab8d8a676d5a1759ac65bd1e2e50282f9926b44a156f7fea5e4ae5883e10f533efb9cd857efb84d23062f9741b4bd2ba70abcb3*
jfoug commented 9 years ago

Franks issue fixed on CPU with d1572a2

The same patch (for opencl), can easily cause the last 2 hashes to fail valid, if the valid changes I just did get ported, BUT:

} else if (usage == 255 && spec == 3 && algorithm == 1) {
        /* UNK */
        /* gpg --homedir . --s2k-cipher-algo 3des --simple-sk-checksum --gen-key */
-       ex_flds = 1; /* handle p */
+       ex_flds = 0; /* do NOT handle p at this time.  Cause the hash to be invalid. */
    } else {
jfoug commented 9 years ago

86ead19 Ports to opencl I did make the change listed in my above comment, and this causes the last 2 hashes to be invalid (on opencl), UNTIL we can handle them.

$ ../run/john gpg.in -form=gpg
Loaded 2 password hashes with 2 different salts (gpg, OpenPGP / GnuPG Secret Key [32/64])
Press 'q' or Ctrl-C to abort, almost any other key for status
openwall         (3)
openwall         (2)
2g 0:00:00:00 DONE 1/3 (2014-11-23 10:05) 43.47g/s 347.8p/s 347.8c/s 347.8C/s 2..22
Use the "--show" option to display all of the cracked passwords reliably
Session completed

$ ../run/john gpg.in -form=gpg-opencl
No password hashes loaded (see FAQ)