Somewhere in 2014, I found a file in the BSD 3 source tree dumps with passwords of all the veterans like Dennis Ritchie, Ken Thompson, Brian W. Kernighan, Steve Bourne, and Bill Joy.
The algorithm used for these hashes was based on DES — known for its weakness (with a maximum password length of 8 characters). So I thought it would be easy to crack these passwords for fun.
We take standard bruteforcers and .
I quickly cracked many passwords, most of which were very weak (interestingly, bwk used the password /.,/.,, - it's easy to type on a QWERTY keyboard).
But Ken's password was uncrackable. Even a full brute force of all lowercase letters and digits (several days in 2014) yielded no results. Since the algorithm was developed by Ken Thompson and Robert Morris, I was curious about the matter. I also realized that, compared to other password hashing schemes like NTLM, crypt(3) is quite slow to brute force (possibly less optimized).
Did he use uppercase letters or even special characters? (A 7-bit full brute force will take over two years on a modern GPU).
At the beginning of October, this topic on the mailing list , and I and disappointment that I couldn't crack Ken's password.
Finally, today Nigel Williams revealed this mystery:
From: Nigel Williams
Subject: Re: [TUHS] Recovery of files /etc/passwdKen is ready:
ZghOT0eRm4U9s:p/q2-q4!
It took over four days on an AMD Radeon Vega64 in hashcat at about 930MH/s (those in the know are aware that the hash rate fluctuates and decreases towards the end).
This is the first move of the pawn two squares in and the beginning , which fits very well into .
I'm very glad the mystery has been solved and that the result is so pleasant.
Source: habr.com
