The Best64 challenge finished recently. For those who were unaware of its existence, it was about creating a set of 64 mangling rules that were optimized for a given dictionary and a given password file. As I am pretty interested by this topic, I tried to compete with my own set of tools (that are released by the way). Unfortunately, all my tools are setup to work with John the Ripper, and while the mangling rules are somewhat compatible, they are not entirely.
It turns out that I managed to get 22194 matches with my scripts. I only played for about 4 hours, but I should have had a considerable advantage as I already had all the scripts ready. It turns out that I would only have reached the 7th spot, IF my rules translated to Hashcat. This means several things :
- My “base” rules were not comprehensive : looking at the solutions I realized this was indeed the case. The rule set has been fleshed out considerably.
- Solving the coverage problem with a greedy algorithm works well only with a large set of rules. With only 64 rules a much better solution is required, but my tools were designed for working with much larger data sets. It means that the NP-hardness of the problem is a practical limitation here, when handling millions of rules.
- The approach of combining a base rule with some characters appended before and/or after is not optimal. This is pretty obvious, but I thought it was a minor concern. It turns out it is not with this challenge.
I will try to compute a new rule list with the new “base” rules, but it requires more than a terabyte of disk space right now.