See I thought, hmm this is going to be an important password letts think up a new one (mistake!), used it a couple of times then didn't use it for a few months and now BUMMER!

Now I've already submitted my gpg key to: pgp.mit.edu. I could ofcourse just nuke my current .gpg dir and start from scratch since not many people have my public key already, but then my old key would still be registered at pgp.mit.edu .

I'm already quite embaressed about this as it is, so no that is SO stupid replies please.

tor, 16.12.2004 kl. 21.23 skrev Hans de Goede: > Hi, > > Some time ago I've done attempts of packages for svgalib on yodl, before > this I didn't really have a need for pgp, so I didn't use gpg. I've done > a few (signed) test releases of packages for svgalib and yodl, but those > got stuck in the QA queue. After this I turned my attention to some > other projects (xmame mainly). > > Then some time ago I decided that I wanted to try again to get those > package through the QA queue, and ... oops I forgot my gpg password :| > > See I thought, hmm this is going to be an important password letts think > up a new one (mistake!), used it a couple of times then didn't use it > for a few months and now BUMMER! > sounds familiar > Seeing how Fedora-Extras is really shaping up now I really would like to > become an active community member (not a good start this) and do some > packaging. > > Now I've already submitted my gpg key to: pgp.mit.edu. > I could ofcourse just nuke my current .gpg dir and start from scratch > since not many people have my public key already, but then my old key > would still be registered at pgp.mit.edu . > > The faq at pgp.mit.edu also doesn't make me happy (at all) anything I > can do? > > I'm already quite embaressed about this as it is, so no that is SO > stupid replies please. > > Thanks & Regards, > > Hans I'm in the same pos, only nobody exept RH translation project know about my key...

On Friday 17 December 2004 08:19, Paul Iadonisi <pri.rhl3(a)iadonisi.to&gt; wrote: > Maybe the new dual Opteron box I just ordered can crack the passwords >for both our keys. ;-) I wrote a program to crack keys with a hacked version of gpg (at the point in the code where it asks for the pass-phrase my code inserted a loop to go through the passwords). It's ugly but with the recent versions of gpg it works reasonably well (I discovered a memory leak whereby gpg would lose a couple of hundred bytes every attempt at a pass-phrase). The program could try over 600 combinations a second on a 2-3yo Athlon giving almost 5 digits tested per day if you only use lower-case and digits. This means that a pass-phrase of 6 characters comprising lower-case and digits could be reliably cracked in just over a month. 7 characters could be done in 3 years with an old Athlon or maybe some reasonable amount of time in a dual-Opteron. 8 or more characters would require a large network of machines. Let me know if you want a copy of my code, but be warned, it's really ugly. Also it might be possible to optimise things and maybe double the speed if you can figure out GPG memory management (I can't).

On Friday 17 December 2004 08:19, Paul Iadonisi <pri.rhl3(a)iadonisi.to&gt; wrote: > Maybe the new dual Opteron box I just ordered can crack the passwords > for both our keys. ;-) I wrote a program to crack keys with a hacked version of gpg (at the point in the code where it asks for the pass-phrase my code inserted a loop to go through the passwords). It's ugly but with the recent versions of gpg it works reasonably well (I discovered a memory leak whereby gpg would lose a couple of hundred bytes every attempt at a pass-phrase).

The program could try over 600 combinations a second on a 2-3yo Athlon giving almost 5 digits tested per day if you only use lower-case and digits. This means that a pass-phrase of 6 characters comprising lower-case and digits could be reliably cracked in just over a month. 7 characters could be done in 3 years with an old Athlon or maybe some reasonable amount of time in a dual-Opteron. 8 or more characters would require a large network of machines. Let me know if you want a copy of my code, but be warned, it's really ugly. Also it might be possible to optimise things and maybe double the speed if you can figure out GPG memory management (I can't). -- http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark http://www.coker.com.au/postal/ Postal SMTP/POP benchmark http://www.coker.com.au/~russell/ My home page

On Wednesday 29 December 2004 09:58, Kyrre Ness Sjobak <kyrre(a)solution-forge.net&gt; wrote: > man, 27.12.2004 kl. 18.01 skrev Russell Coker: > > On Friday 17 December 2004 08:19, Paul Iadonisi <pri.rhl3(a)iadonisi.to&gt; wrote: > > > Maybe the new dual Opteron box I just ordered can crack the passwords > > > for both our keys. ;-) > > > > I wrote a program to crack keys with a hacked version of gpg (at the > > point in the code where it asks for the pass-phrase my code inserted a > > loop to go through the passwords). It's ugly but with the recent > > versions of gpg it works reasonably well (I discovered a memory leak > > whereby gpg would lose a couple of hundred bytes every attempt at a > > pass-phrase). > > What if it tried a dictionary first? Using a dictionary might get a faster attack or make cracking a long password feasible. But surely no-one is using a password that would be so easily cracked... -- http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark http://www.coker.com.au/postal/ Postal SMTP/POP benchmark http://www.coker.com.au/~russell/ My home page -- fedora-devel-list mailing list fedora-devel-list(a)redhat.com http://www.redhat.com/mailman/listinfo/fedora-devel-list