Date: Wed, 23 Jun 2010 11:25:20 -0400
From: "John Lightfoot" <jlightfoot@...il.com>
To: "'Thor \(Hammer of God\)'" <Thor@...merofgod.com>,
	<full-disclosure@...ts.grok.org.uk>
Subject: Re: TGP v1.1.13.3

This looks great, but I have a question about your "how long would it take
to crack *this* password" analysis on your web site.  In your example, you
choose aaaaaaNotGood, a 13 character mixed case password, and said it could
be cracked in 44 days.  But to crack a 13 digit mixed case password (knowing
in advance it was mixed case), wouldn't you have to enumerate through the
entire 12 digit and smaller keyspaces before you get to the 13 digit
keyspace?  

 

So you'd have to go through 52^1+52^2+.+52^12 before starting on the 13
digit keyspace, which would take much longer than 44 days.  It would only be
44 days if you knew both the keyspace and the length.

 

From: full-disclosure-bounces@...ts.grok.org.uk
[mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of Thor (Hammer
of God)
Sent: Wednesday, June 23, 2010 2:25 AM
To: full-disclosure@...ts.grok.org.uk
Subject: [Full-disclosure] TGP v1.1.13.3

 

I've made some major revisions to TGP over that last couple of weeks, and am
releasing v1.1.13.3:

 

http://www.hammerofgod.com/tgp.html

 

It's on the main site now and I've moved all the pilot stuff over to the HoG
production site.   

 

Notably, there is support for key creation to 16384 bits, which pretty much
also required for me to build multi-threading capabilities in so that you
could go do other stuff while processing huge keys if you wanted to.  

 

Also, based on some dialog on FD where some folks didn't quite get the math
behind creating large keys and protecting keys with long and complex
passphrases, I added a feature where I calculate the actual time required to
crack your password keyspace based on Class F cracking speeds of
1,000,000,000 passwords per second.  I've always been less-than-thrilled
with methods of determining how strong a particular password was because
"strong" doesn't mean anything by itself.  "Complex" means something insofar
as structure is concerned, but it doesn't translate into real-world
applications:  Upper, Lower, and Digit for instance doesn't mean much to a
person - so I actually calculate out the time it takes based on the keyspace
used in your password as you type it in so that you can see right then that
it may only take 1 year/day/minute to crack your password. 

 

Further, something I've not seen anywhere else is an actual measurement of
what it will take to crack YOUR password as you type it, not just the
keyspace.  To brute force up to a two character lower case alpha
passphrase's keyspace will take 702 iterations (not 676 like most people
will tell you since it's only 676 if you start at "aa").  However, if you
actually typed in "jx" as your password, that would crack in only 284
iterations.   So I also built in the calculation for what your actual
password will crack in as well, not just the keyspace.  Of course, there are
some assumptions I must make about base keyspace which are explained on the
website if anyone cares to read it.  There's a bunch of other things listed
as well  if you would like to check it out. 

 

Next thing on the list is to move from memorystreams to parallel processing
in smaller blocks so that I'm not dependent on machine memory to encrypt
really big files.  I'll set up a mailing list at some point for people who
would like release info.

 

t

 

Description: Description: Description: TimSig

Timothy "Thor" Mullen

Hammer of God

thor@...merofgod.com

www.hammerofgod.com

 


Content of type "text/html" skipped

Download attachment "image001.png" of type "image/png" (1327 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists