DES-ECB Example hashes and HEX passwords?

[halexan]

The newest hashcat beta added new mode DES-ECB.

So, is there a DES-ECB example hash?

[atom]

root@ht:~/hashcat# echo hashcat1 | tools/test.pl passthrough 14000
24ac458a29cc3241:5337554801018442

[halexan]

Thank you @atom.

Well, I have another question. How can I use hex password for DES? I searched the forum many times, and I read mask attack wiki, but there is no result.

I tried the following command, it didn't work

Code:

hashcat64.exe -a 3 -m 14000 DES.hash ?b?b?b?b?b?b?b?b

but this worked

Code:

hashcat64.exe -a 3 -m 14000 DES.hash ?a?a?a?a?a?a?a?a

However, built in charset "?a" is not HEX, "?b" is hex but it didn't work. To the best of mt knowledge, the key of DES is HEX. 

Am I somewhere wrong?

And, I noticed that @atom just pushed a new file(DES_full.charset) to hashcat repository, what is DES_full.charset using for? 

Noticing that there is a DES_full.charset, I tried a new command:

Code:

hashcat64.exe -a 3 -m 14000 DES.hash -1 DES_full.charset --hex-charset ?1?1?1?1?1?1?1?1

It worked, I think the above command is right!!!

[halexan]

Uh... Is the following keyspace calculation right?

Code:

hashcat64.exe -a 3 -m 14000 DES.hash -1 DES_full.charset --hex-charset ?1?1?1?1?1?1?1?1 --keyspace
34359738368

DES key space is 2^56, but 34359738368 ≠ 2^56, is there something wrong or am I wrong?

[atom]

Yeah DES_full.charset is what you're looking for if you want to search the entire keyspace of DES. The command you used is correct, too.

The --keyspace however does not reflect the entire search space (that's what you mean by 2^56). It's abstracted hashcat-internal range you can use to divide packets for distributed computing. See here for details: https://hashcat.net/wiki/doku.php?id=fre...a_keyspace

From a math view:

2^56 = 128^8

128^8 = 128^5 * 128^3

128^5 = 34359738368

You can only "distribute" the base portion of the search space, not the modifier portion. That's the only way to make GPU work efficient for fast algorithms like DES. So all you need to know is that you need to partition the 128^5 to your compute nodes and the 128^3 are applied by hashcat automatically.

[halexan]

Thank you @atom!