John The Ripper unable to crack long PDF passwords

Question

Steps I follow:

1. I protected a PDF with a long password (I am trying with 38 characters password).
2. I created a dictionary that contains the password to crack the PDF with John the Ripper.
3. I run john --wordlist=mydictionary.txt pdfhash.txt and John is unable to crack the password.

This only happens with long passwords, with small passwords John is working fine. You can try.

Possible matters:

1. PDF stores long passwords differently from normal ones.
2. John The Ripper doesn't read long passwords in the dictionary well.

I want to know how exactly the system works to learn to crack properly with John.

Answer 1

Hash formats in John have maximum password lengths. These often aren't listed in the documentation, but you can find them in the source:

#define PLAINTEXT_LENGTH    32

These may be related to limitations of the algorithms (such as with Bcrypt), or due to optimisations in the code that only works for passwords below a certain length. If you want to extend it beyond 32 characters (without a significant performance impact), I'm sure the developers would welcome a PR.

Answer 2

Cached references online indicate that the maximum length of a PDF password was 32 for some time. Looking at the five different major hashcat modes for PDF, it looks like only the most recent types (Acrobat 9 - 11) support up to 127:

Hash mode #10400
  Name................: PDF 1.1 - 1.3 (Acrobat 2 - 4)
  Password.Len.Max....: 32

Hash mode #10500
  Name................: PDF 1.4 - 1.6 (Acrobat 5 - 8)
  Password.Len.Max....: 32

Hash mode #25400
  Name................: PDF 1.4 - 1.6 (Acrobat 5 - 8) - user and owner pass
  Password.Len.Max....: 32

Hash mode #10600
  Name................: PDF 1.7 Level 3 (Acrobat 9)
  Password.Len.Max....: 127

Hash mode #10700
  Name................: PDF 1.7 Level 8 (Acrobat 10 - 11)
  Password.Len.Max....: 127

You might try truncating your password to 32 characters and see if it validates, or trying to crack it with hashcat, in order to narrow down what JtR's behavior is here. It's possible that JtR needs to be updated.