Last updated at Wed, 26 Jul 2017 14:29:06 GMT
Yes, that's a Buffy reference. And an awesome one at that. I make no apologies for my geekery.
It's also a reference to the update to John the Ripper, released today. As you may've heard by now, the Openwall guys announced an update to their popular password cracker, with a very impressive 17% improvement in gate count for the Data Encryption Standard (DES) algorithm. Congratulations to the Openwall team and all of the open source community members who contribute their time and expertise to furthering John the Ripper!
To put what they've achieved into context, developers have been working on more optimal DES S-box expressions since 1998 and now the guys at Openwall have come up with a new algorithm that yields this significant improvement over the corresponding prior results.
The team has generated different S-box expressions targeting both typical CPUs with only basic instructions and CPUs/GPUs that have "bit select" instructions. The S-box expressions generated under this effort are being made publicly available, are not copyrighted and are free for reuse by anyone. Other applications will likely reuse them for a similar speedup and moreover, the research behind this is of scientific value, in areas such as cryptography and logic circuit minimization.
In terms of the implications of the new version of John the Ripper for information security professionals, organizations using it will be able to audit their users' passwords and respond to the findings (such as a certain percentage getting cracked in 1 day) before the password hashes would leak. The speed increase is obviously helpful in this case.
A good way to respond to such findings would be to make multiple kinds of improvements at once, including switching to a more appropriate password hash type (John the Ripper supports many, with very differentproperties and efficiency of attacks), adding proactive password strength checking (which Openwall provides a software library for, called passwdqc) and finally, asking and then requiring users with weak passwords to change them. Further, John the Ripper runs would be needed to validate the effect of these measures and to adjust them accordingly.
Additionally, in the event of an identified compromise of the password database, the organization would be prepared to block accounts with the weakest passwords first, then proceed to deal with the rest as customer support capacity permits. This would minimize the inconvenience to users and the burden on customer support (no hard requirement to have all passwords blocked/ changed in one day).
Rapid7's been sponsoring John the Ripper for the past year as part of our ongoing commitment to the open source infosec community. We're so impressed by the great things Openwall has been doing while we've been backing them, not just in this release of John the Ripper, but also the recent addition of support for Intel AVX and AMD XOP instruction set extensions, as well as parallelization of the bitslice DES implementation with OpenMP (formulti-core and multi-CPU machines).
Working with Openwall to support this project has also enabled the Rapid7 team to develop greater technical integration with the John the Ripper solution for upcoming versions of Metasploit.
You can find out all about the new John the Ripper release here.
Congratulations again to the team! Keep up the good work ;-)
