OpenSSL finds too many false postives
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 13.6k
- Forks
- 2.6k
- PR merge metrics
- No merged PRs in 30d
Description
OpenSSL hashs find too many false postives when running in John
However searching on Github I noticed:
https://github.com/glv2/bruteforce-salted-openssl
Solves false positive cases where decryption fails but password candidate is accepted as a solution for ignoring the result of EVP_DecryptUpdate.
The false positive issue was solved 8 months ago for this script:
https://github.com/glv2/bruteforce-salted-openssl/blob/master/src/bruteforce-salted-openssl.c
This programs also allows the option to define which cipher and digest to try.
I was hoping both of these could potentially be incorporated into John in a future update
Many Thanks
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating John's OpenSSL hash implementation and compare its decryption-result handling with the referenced bruteforce-salted-openssl source. Check how cipher and digest selection currently work, then define completion as eliminating false-positive candidates while preserving valid matches and supporting the requested options.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- cryptography, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100