Re: [Full-disclosure] TGP v1.1.13.3

["Thor (Hammer of God)" <Thor@xxxxxxxxxxxxxxx>]

FYI, after taking it offline, there was confusion about what was being done and 
when.  The below comments are not an issue as I understand it.

If anyone would like to offer opinions after reading the markup, they are 
welcome.

t

From: full-disclosure-bounces@xxxxxxxxxxxxxxxxx 
[mailto:full-disclosure-bounces@xxxxxxxxxxxxxxxxx] On Behalf Of Thor (Hammer of 
God)
Sent: Wednesday, June 23, 2010 8:36 AM
To: John Lightfoot; full-disclosure@xxxxxxxxxxxxxxxxx
Subject: Re: [Full-disclosure] TGP v1.1.13.3

Took me a second to know what you were saying - I was already replying that I 
*did* go through the required space.  But I think you are right - in the 
algorithm I'm using, I "stop" at the character in each column since I know what 
it is.  If I read you correctly, your saying that it would only matter on the 
most significant column, right?  IOW, just because I put an "a" in columns 
12,11,10,9, and 8, to get to the "a" in column 13, I'd have to go through ZZZZZ 
in those columns first, which I DON'T think I'm doing.

Yes, I think you are right - I must have been mixing post-Rainbow Table 
matching with brute force iterations.  Oh well.  Looks like I've got some more 
coding to do tonight, assuming I understand what you are saying...

t

From: John Lightfoot [mailto:jlightfoot@xxxxxxxxx]
Sent: Wednesday, June 23, 2010 8:25 AM
To: Thor (Hammer of God); full-disclosure@xxxxxxxxxxxxxxxxx
Subject: RE: [Full-disclosure] TGP v1.1.13.3

This looks great, but I have a question about your "how long would it take to 
crack *this* password" analysis on your web site.  In your example, you choose 
aaaaaaNotGood, a 13 character mixed case password, and said it could be cracked 
in 44 days.  But to crack a 13 digit mixed case password (knowing in advance it 
was mixed case), wouldn't you have to enumerate through the entire 12 digit and 
smaller keyspaces before you get to the 13 digit keyspace?

So you'd have to go through 52^1+52^2+...+52^12 before starting on the 13 digit 
keyspace, which would take much longer than 44 days.  It would only be 44 days 
if you knew both the keyspace and the length.

From: full-disclosure-bounces@xxxxxxxxxxxxxxxxx 
[mailto:full-disclosure-bounces@xxxxxxxxxxxxxxxxx] On Behalf Of Thor (Hammer of 
God)
Sent: Wednesday, June 23, 2010 2:25 AM
To: full-disclosure@xxxxxxxxxxxxxxxxx
Subject: [Full-disclosure] TGP v1.1.13.3

I've made some major revisions to TGP over that last couple of weeks, and am 
releasing v1.1.13.3:

http://www.hammerofgod.com/tgp.html

It's on the main site now and I've moved all the pilot stuff over to the HoG 
production site.

Notably, there is support for key creation to 16384 bits, which pretty much 
also required for me to build multi-threading capabilities in so that you could 
go do other stuff while processing huge keys if you wanted to.

Also, based on some dialog on FD where some folks didn't quite get the math 
behind creating large keys and protecting keys with long and complex 
passphrases, I added a feature where I calculate the actual time required to 
crack your password keyspace based on Class F cracking speeds of 1,000,000,000 
passwords per second.  I've always been less-than-thrilled with methods of 
determining how strong a particular password was because "strong" doesn't mean 
anything by itself.  "Complex" means something insofar as structure is 
concerned, but it doesn't translate into real-world applications:  Upper, 
Lower, and Digit for instance doesn't mean much to a person - so I actually 
calculate out the time it takes based on the keyspace used in your password as 
you type it in so that you can see right then that it may only take 1 
year/day/minute to crack your password.

Further, something I've not seen anywhere else is an actual measurement of what 
it will take to crack YOUR password as you type it, not just the keyspace.  To 
brute force up to a two character lower case alpha passphrase's keyspace will 
take 702 iterations (not 676 like most people will tell you since it's only 676 
if you start at "aa").  However, if you actually typed in "jx" as your 
password, that would crack in only 284 iterations.   So I also built in the 
calculation for what your actual password will crack in as well, not just the 
keyspace.  Of course, there are some assumptions I must make about base 
keyspace which are explained on the website if anyone cares to read it.  
There's a bunch of other things listed as well  if you would like to check it 
out.

Next thing on the list is to move from memorystreams to parallel processing in 
smaller blocks so that I'm not dependent on machine memory to encrypt really 
big files.  I'll set up a mailing list at some point for people who would like 
release info.

t

[Description: Description: Description: TimSig]
Timothy "Thor" Mullen
Hammer of God
thor@xxxxxxxxxxxxxxx<mailto:thor@xxxxxxxxxxxxxxx>
www.hammerofgod.com<http://www.hammerofgod.com>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/