openwall / openwall/john

HDDA not supporting uri containing a colon

Open
#5,513 8 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

documentation question
Dominant language
C
Stars
13.6k
Forks
2.6k
PR merge metrics
No merged PRs in 30d

Description

I tried to determine a password for F1 from an example in https://www.rfc-editor.org/rfc/rfc3665#page-7:

Authorization: Digest username="bob", realm="atlanta.example.com",
 qop="auth", nonce="1cec4341ae6cbe5a359ea9c8e88df84f", opaque="",
 uri="sips:ss2.biloxi.example.com",
 response="71ba27c64bd01de719686aa4590d5824"

I was stuck on john not liking the legacy variant:

$ john digest.txt --show=invalid
bob:$response$6629fae49393a05397450978507c4ef1$bob$atlanta.example.com$REGISTER$sips:ss2.biloxi.example.com$ea9c8e88df84f1cec4341ae6cbe5a359$
0 valid hashes, 1 invalid hash

(I later realized that the Authorization header itself is actually invalid but that is unrelated to this report.)

Looks like it does not like the colon in the uri since when I delete it, I get

$ john digest.txt --show=invalid
1 valid hash, 0 invalid hashes

Using absolute URI is allowed by the specification:

; https://www.rfc-editor.org/rfc/rfc2617#section-3.2.2
digest-uri       = "uri" "=" digest-uri-value
digest-uri-value = request-uri   ; As specified by HTTP/1.1
; https://www.rfc-editor.org/rfc/rfc2616#section-5.1.2
Request-URI    = "*" | absoluteURI | abs_path | authority
; https://www.rfc-editor.org/rfc/rfc2396#page-11
absoluteURI   = scheme ":" ( hier_part | opaque_part )

It is also commonly used by Session Initiation Protocol, which does not even allow non-absolute URIs.


I modified the Nix package to point to 367d6438e6bd5cfd20f3290aac479ab4f1e5fea2:

$ john --list=build-info
Version: 1.9.0-jumbo-1+bleeding-$
Build: linux-gnu 64-bit x86_64 SSE2 AC OMP OPENCL
SIMD: SSE2, interleaving: MD4:3 MD5:3 SHA1:1 SHA256:1 SHA512:1
System-wide exec: /nix/store/i89m6qix9pragyqc5s7fqfg8gcm2412c-john-bleeding/bin
System-wide home: /nix/store/i89m6qix9pragyqc5s7fqfg8gcm2412c-john-bleeding/share/john
Private home: ~/.john
$JOHN is /nix/store/i89m6qix9pragyqc5s7fqfg8gcm2412c-john-bleeding/share/john/
Format interface version: 14
Max. number of reported tunable costs: 4
Rec file version: REC4
Charset file version: CHR3
CHARSET_MIN: 1 (0x01)
CHARSET_MAX: 255 (0xff)
CHARSET_LENGTH: 24
SALT_HASH_SIZE: 1048576
SINGLE_IDX_MAX: 2147483648
SINGLE_BUF_MAX: 4294967295
Effective limit: Number of salts vs. SingleMaxBufferSize
Max. Markov mode level: 400
Max. Markov mode password length: 30
gcc version: 13.3.0
GNU libc version: 2.39 (loaded: 2.39)
OpenCL headers version: 1.2
Crypto library: OpenSSL
OpenSSL library version: 0300000e0
OpenSSL 3.0.14 4 Jun 2024
GMP library version: 6.3.0
File locking: fcntl()
fseek(): fseek
ftell(): ftell
fopen(): fopen
memmem(): System's
times(2) sysconf(_SC_CLK_TCK) is 100
Using times(2) for timers, resolution 10 ms
HR timer: clock_gettime(), latency 38 ns
Total physical host memory: 7842 MiB
Available physical host memory: 3063 MiB
Terminal locale string: en_GB.UTF-8
Parsed terminal locale: UTF-8

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the HDDA case with john digest.txt --show=invalid, comparing the URI containing sips: with the version where the colon is removed. Trace the HDDA format's handling of the digest URI and verify the RFC example is accepted as valid when the absolute URI is retained.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.