In 2014, I found a file with passwords of all veterans like Dennis Ritchie, Ken Thompson, Brian W. Kernighan, Steve Bourne, and Bill Joy.
The algorithm used for these hashes was based on DES — known for its weakness (and with a maximum password length of 8 characters). So I thought it would be easy to crack these passwords for fun.
We take standard bruteforcers. en .
I quickly cracked many passwords, most of which were very weak (curiously, bwk used the password /.,/.,, — easy to type on a QWERTY keyboard).
But Ken's password was uncrackable. Even a complete brute-force of all lowercase letters and numbers (several days in 2014) yielded no results. Since the algorithm was designed by Ken Thompson and Robert Morris, I was curious about what was going on. I also realized that compared to other password hashing schemes like NTLM, crypt(3) is quite slow to brute-force (possibly less optimized).
Did he use uppercase letters or even special characters? (A full 7-bit brute-force would take more than two years on a modern GPU).
At the beginning of October, this topic on the mailing list , and I and disappointment about not being able to crack Ken's password.
Finally, today Nigel Williams revealed the secret:
From: Nigel Williams
Subject: Re: [TUHS] Recovering files /etc/passwdKen is ready:
ZghOT0eRm4U9s:p/q2-q4!
It took over four days on an AMD Radeon Vega64 in hashcat at about 930MH/s (those in the know are aware that hash rates fluctuate and decline toward the end).
This is the first pawn move two squares in and the start , which fits very well in .
I'm very glad that the mystery was solved, and the result is so pleasant.
Bron: habr.com
