I have been discussing this tweet https://twitter.com/marcan42/status/1238125727855206400 and the conversation around it with some folks on an encryption module I am doing as part of a cyber security masters course and it's made me curious.

The relevant part of the conversation is this:


That is the SHA256 of the 76-character passphrase to my master backups, plus '!'.

Pwn me. I'm waiting."

Making the assumption here that the passphrase in this tweet is composed entirely of lowercase English words it seems to me that it should be easy to create a custom dictionary of 76 character passphrases from a large English wordlist.

Is there a way to get a tool like hashcat or john to do this on the fly from a wordlist in the same way you can do patterns like "?l?l?l?l?d" (4 lowercase alpha followed by a digit) in hashcat or would it require building the custom dictionary first and passing it in?

  • Just to add some interesting extra info according to my calcs a 76 character random password using (a-z, A-Z, 0-9, $%!@+=) gives an entropy of log2(68^76) giving ~ 462 bits of entropy. Even only lowercase alpha gives ~357 bits. However going by what we have been taught using only proper English words gives ~1.3 bits per character giving ~98 bits of entropy which might come close to being crackable... – DavidM Mar 13 '20 at 11:22
  • I'm not sure why you would want to use hashcat or john for whole words. A simple script is more efficient. – schroeder Mar 13 '20 at 11:35
  • 1
    Here is the point: "This is one hashed/encrypted thing. Decrypt it! I'm waiting!" is a terrible way to argue anything in crypto. – MechMK1 Mar 13 '20 at 11:43
  • Despite the tweet and this specific password, your question boils down to a simple question: how to use a dictionary to feed a password cracker to permutate phrases of different lengths. Once you focus on the goal, the search terms are easier (and looking up the documentation is easier, too). And what you want is easily done via a script. – schroeder Mar 13 '20 at 12:14