软暴力破解您自己的 GPG/PGP 密码的最佳方法是什么？
我创建了一个很好的长密码，用了几次，然后就忘记了;) 问题是，我知道总体主题，可能还知道几乎所有角色。 我内心的完美主义者不想撤销密钥或类似的东西（而且我认为无论如何我都需要密码来撤销它，对吧？）。 我觉得我应该能够通过暴力强制我错误/输入错误的可能布局/字符来很好地解决这个问题。 我编写了一个 C 程序来生成这样的组合。 不幸的是，我手头没有代码（我现在会以“不相关”为借口；）。 我还在网上发现了一些使用 GPGME 来完成此操作的代码，作为概念验证。 它有评论“这很容易快 100 倍”。 问题是，分析代码显示瓶颈是 GPGME 调用本身。 这是预期的，还是 GPGME 的限制可以使用完整的库或专用实现来解决？
你会怎样做呢？ 显然，这种方法对于任何像样的未知密码都是不可行的，但我认为关键是我知道我输入的内容，但不知道如何的确切格式> 我输入了它 - 应该是可行的，不是吗？
I created a nice long passphrase, used it a few times, then forgot it ;) The twist is, I know the general theme and probably almost all of the characters. The perfectionist in me doesn't want to revoke the key or anything like that (and I think I need the passphrase to revoke it anyway, right?). I feel I should be able to have a good go at this by brute-forcing the likely layouts/characters that I've got wrong/mis-typed. I wrote a C program to produce such combinations. Unfortunately I don't have the code to hand (I'll go with the "it's not relevant" excuse for now ;). I also came across some code on the web using GPGME to do exactly this as a proof-of-concept. It had the comment "this could easily be 100 times faster". Problem is, profiling the code shows the bottleneck to be the GPGME call itself. Is this expected, or is it a limitation of GPGME that could be solved using the full library or a dedicated implementation?
How would you go about doing this? Obviously this method is infeasible for any decent unknown passphrase, but I think the key is that I know what I typed without knowing the exact formatting of how I typed it - should be feasible, no?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
不，您需要撤销密钥。 您应该在创建密钥时生成并打印出来。 然后将其存储在安全的地方，而不是当您不希望有人可以使用它来撤销您的密钥的地方。
我曾尝试暴力破解我几乎记住的密码，但没有成功。 仍然有很多排列，并且需要很多规则来确定什么之后会发生什么，以将其缩小到合理的问题规模。 我从来没有在这方面尝试过太多，因为幸运的是我从来没有忘记我的 GPG 密码。 大多数情况下，当我忘记密码时，它是登录到大学的远程计算机，我从来不想用我的猜测来敲击 ssh 端口或网络邮件。
也许您调用的函数做了很多不依赖键的设置？ 因此，您可以通过将代码从库中复制出来并稍后将暴力循环放入其中来加快速度。
No, you need the revocation key. Which you should have generated and printed out when you created your key. Then stored it in a safe place, not where someone could use it to revoke your key when you don't want them to.
I've tried to brute-force passwords that I almost remembered, but without success. There are still a lot of permutations, and it takes a lot of rules on what can come after what to narrow it down to a reasonable problem size. I never tried too hard on this, since I luckily have never forgotten my GPG passphrase. Mostly when I've forgotten a password it's a login to a remote machine at the university, and I've never wanted to hammer on the ssh port, or webmail, with my guesses.
Maybe the function you're calling does a lot of setup that is non-key-dependent? So you could speed it up by copying the code out of the library and putting your brute-force loop later on in it.
使用 exrex 使用正则表达式创建彩虹并将其存储在文件中
生成彩虹后，使用
循环遍历 Rainbow.txt 并将密码输入到上述命令中。
或者更好地使用这个： https://github.com/Narthorn/gpg-bruteforce
Use exrex to create the rainbow using regexp and store it in a file
Once this rainbows are generated use the
Loop through the rainbow.txt and input the passphrase to the above command.
Or even better use this: https://github.com/Narthorn/gpg-bruteforce