full-disclosure - TGP v1.1.13.3

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <optid.3790a10b38.58DB1B68E62B9F448DF1A276B0886DF12DB634EC@EX2010.hammerofgod.com>
Date: Wed, 23 Jun 2010 06:24:50 +0000
From: "Thor (Hammer of God)" <Thor@...merofgod.com>
To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: TGP v1.1.13.3

I've made some major revisions to TGP over that last couple of weeks, and am releasing v1.1.13.3:

http://www.hammerofgod.com/tgp.html

It's on the main site now and I've moved all the pilot stuff over to the HoG production site.

Notably, there is support for key creation to 16384 bits, which pretty much also required for me to build multi-threading capabilities in so that you could go do other stuff while processing huge keys if you wanted to.

Also, based on some dialog on FD where some folks didn't quite get the math behind creating large keys and protecting keys with long and complex passphrases, I added a feature where I calculate the actual time required to crack your password keyspace based on Class F cracking speeds of 1,000,000,000 passwords per second.  I've always been less-than-thrilled with methods of determining how strong a particular password was because "strong" doesn't mean anything by itself.  "Complex" means something insofar as structure is concerned, but it doesn't translate into real-world applications:  Upper, Lower, and Digit for instance doesn't mean much to a person - so I actually calculate out the time it takes based on the keyspace used in your password as you type it in so that you can see right then that it may only take 1 year/day/minute to crack your password.

Further, something I've not seen anywhere else is an actual measurement of what it will take to crack YOUR password as you type it, not just the keyspace.  To brute force up to a two character lower case alpha passphrase's keyspace will take 702 iterations (not 676 like most people will tell you since it's only 676 if you start at "aa").  However, if you actually typed in "jx" as your password, that would crack in only 284 iterations.   So I also built in the calculation for what your actual password will crack in as well, not just the keyspace.  Of course, there are some assumptions I must make about base keyspace which are explained on the website if anyone cares to read it.  There's a bunch of other things listed as well  if you would like to check it out.

Next thing on the list is to move from memorystreams to parallel processing in smaller blocks so that I'm not dependent on machine memory to encrypt really big files.  I'll set up a mailing list at some point for people who would like release info.

t

[Description: Description: Description: TimSig]
Timothy "Thor" Mullen
Hammer of God
thor@...merofgod.com<mailto:thor@...merofgod.com>
www.hammerofgod.com<http://www.hammerofgod.com>

Content of type "text/html" skipped

Download attachment "image001.png" of type "image/png" (1327 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/