In order to understand what should be done in a real user case, I made this test:
- I created a GnuPG key, with the passphrase
- I exported the private key part of it (ASCII armored)
- I generated the hash file for this part by using the gpg2john utility
- I creted a password.lst file (replacing the default one) with the expression
twothreeas its single line
- running john on the hash file using the --wordlist=password.lst option will find the password almost instantaneous
- running john on the hash file with no other option will find the password after a minute or so, at the stage when it comes to the password list method
- if I split the password from the password.lst file into two lines, i.e.
then john is no longer able to find the password [in reasonable amount of time], regardless if using the --wordlist option or not.
I suppose (?) this involves the rules somehow, but I am not able to proper configure the rules for this usage.
What I want is to instruct john to include all possible combinations of the words (expressions) from the given password.lst file, which in this test can be
two three twothree threetwo.
For a real user case, I need to find a forgotten passphrase that is most likely (only) a combination of a few possible known expressions – not that many, but enough to be too complicated to try manually all of it.
What should be done in order to achieve this ?