4 Commits
Author SHA1 Message Date
nelsbrock 561a4d220b add --stop-after option 2025-10-25 13:53:38 +02:00
nelsbrock 6c7a0b7461 generate ECC keys instead of Ed25519 keys 2025-10-24 01:02:31 +02:00
nelsbrock 6620aa898d add armor comment to output certificates 2025-10-23 23:44:14 +02:00
nelsbrock bbc17385a7 fix README.md 2025-10-23 23:43:16 +02:00
3 changed files with 126 additions and 59 deletions
+21 -20
View File
@@ -13,8 +13,9 @@ cargo install fingerprunk
## Usage
Let's say you want to find keys whose fingerprints begin with `C0FFEE` and store them `secret.asc`.
The regex for this is `^C0FFEE`. Now, simply use the following command to start the search:
Let's say you want to find keys whose fingerprints begin with `C0FFEE` and store them
at `secret.asc`. The regex for this is `^C0FFEE`. Now, simply use the following command to start
the search:
```sh
fingerprunk -r '^C0FFEE' >> secret.asc
@@ -49,25 +50,25 @@ Also see <https://en.wikipedia.org/wiki/Hexspeak> for some further examples of "
### How long does it take?
On my machine with an AMD Ryzen 7 5800X Processor, Fingerprunk is able to generate and check about
43300 keys per second. This means that for finding a fingerprint with a string of *n* specific
On my machine with an AMD Ryzen 7 5800X processor, Fingerprunk is able to generate and check about
41000 keys per second. This means that for finding a fingerprint with a string of *n* specific
hexadecimal digits at a specific place, I could expect the following runtimes until finding the
first key:
| *n* | expected tries | expected time |
| --: | --------------: | ------------: |
| *n* | 16ⁿ | 43300s / 16ⁿ |
| 2 | 256 | 0.0059 secs |
| 3 | 4096 | 0.0946 secs |
| 4 | 65536 | 1.5 secs |
| 5 | 1028576 | 24 secs |
| 6 | 16777216 | 6.5 mins |
| 7 | 268435456 | 103 mins |
| 8 | 4294967296 | 27 hours |
| 9 | 68719476736 | 18 days |
| 10 | 1099511627776 | 293 days |
| 11 | 17592186044416 | 13 years |
| 12 | 281474976710656 | 206 years |
| *n* | estimate tries | estimate time |
| --: | ---------------------: | ------------: |
| 1 | 16 = 16¹ | < 0.1 secs |
| 2 | 256 = 16² | < 0.1 secs |
| 3 | 4096 = 16³ | 0.1 secs |
| 4 | 65536 = 16⁴ | 1.6 secs |
| 5 | 1048576 = 16⁵ | 26 secs |
| 6 | 16777216 = 16⁶ | 7 mins |
| 7 | 268435456 = 16⁷ | 2 hours |
| 8 | 4294967296 = 16⁸ | 1 days |
| 9 | 68719476736 = 16⁹ | 19 days |
| 10 | 1099511627776 = 16¹⁰ | 310 days |
| 11 | 17592186044416 = 16¹¹ | 14 years |
| 12 | 281474976710656 = 16¹² | 218 years |
As you can see, anything above 8 or 9 fixed digits is pretty much unfeasible, at least with
a normal personal computer.
As you can see, anything above 10 fixed digits is pretty much unfeasible, at least with a normal
personal computer.
+96 -38
View File
@@ -2,10 +2,11 @@
use std::{
fmt::{self, Write},
io::{self},
io,
num::NonZeroU64,
sync::{
atomic::{AtomicU64, Ordering},
mpsc::{self, Receiver},
atomic::{AtomicBool, AtomicU64, Ordering},
mpsc,
},
thread,
time::{Duration, Instant},
@@ -14,7 +15,7 @@ use std::{
use fancy_regex::Regex;
use num_integer::Integer;
use sequoia_openpgp::{
Cert, Packet,
Cert, Packet, armor,
crypto::Password,
packet::{
Key,
@@ -22,7 +23,7 @@ use sequoia_openpgp::{
prelude::SignatureBuilder,
},
serialize::Serialize,
types::{HashAlgorithm, SignatureType, SymmetricAlgorithm},
types::{Curve, HashAlgorithm, SignatureType, SymmetricAlgorithm},
};
type SecretKey = Key<SecretParts, PrimaryRole>;
@@ -31,12 +32,15 @@ type SecretKey = Key<SecretParts, PrimaryRole>;
pub struct Config {
pub regex: Regex,
pub status_enabled: bool,
pub stop_after: Option<NonZeroU64>,
pub password: Option<Password>,
}
#[derive(Debug)]
pub struct Fingerprunk {
config: Config,
started_instant: Instant,
stop: AtomicBool,
counter_tried: AtomicU64,
counter_found: AtomicU64,
}
@@ -52,12 +56,16 @@ impl Fingerprunk {
pub fn new_from_config(config: Config) -> Self {
Self {
config,
started_instant: Instant::now(),
stop: AtomicBool::new(false),
counter_tried: AtomicU64::new(0),
counter_found: AtomicU64::new(0),
}
}
pub fn run(self) {
pub fn run(mut self) {
self.started_instant = Instant::now();
let (tx, rx) = mpsc::channel();
thread::scope(|scope| {
@@ -65,12 +73,16 @@ impl Fingerprunk {
let ref_self = &self;
if self.config.status_enabled {
thread::Builder::new()
.name("status_displayer".to_string())
.spawn_scoped(scope, move || ref_self.status_displayer_thread())
.expect(THREAD_SPAWN_EXPECT_MSG);
}
let status_displayer = if self.config.status_enabled {
Some(
thread::Builder::new()
.name("status_displayer".to_string())
.spawn_scoped(scope, move || ref_self.status_displayer_thread())
.expect(THREAD_SPAWN_EXPECT_MSG),
)
} else {
None
};
for num in 0..num_cpus::get() {
let tx = tx.clone();
@@ -81,9 +93,19 @@ impl Fingerprunk {
.expect(THREAD_SPAWN_EXPECT_MSG);
}
let on_stop = || {
// Ask all other threads to stop
self.stop.store(true, Ordering::Relaxed);
// Unpark the status displayer thread
if let Some(status_displayer) = status_displayer {
status_displayer.thread().unpark();
}
};
thread::Builder::new()
.name("finalizer".to_string())
.spawn_scoped(scope, move || ref_self.finalizer_thread(rx))
.spawn_scoped(scope, move || ref_self.finalizer_thread(rx, on_stop))
.expect(THREAD_SPAWN_EXPECT_MSG);
});
}
@@ -91,8 +113,9 @@ impl Fingerprunk {
fn worker_thread(&self, matches_tx: mpsc::Sender<SecretKey>) {
let mut fingerprint_hex = String::with_capacity(20 * 2);
loop {
let key = Key4::generate_ed25519().expect("should be able to generate key");
while !self.stop.load(Ordering::Relaxed) {
let key =
Key4::generate_ecc(true, Curve::Ed25519).expect("should be able to generate key");
fingerprint_hex.clear();
write!(fingerprint_hex, "{:X}", key.fingerprint())
.expect("should write into string without error");
@@ -113,20 +136,25 @@ impl Fingerprunk {
.expect("should check regex without error")
}
fn finalizer_thread(&self, matches_rx: Receiver<SecretKey>) {
fn finalizer_thread(&self, matches_rx: mpsc::Receiver<SecretKey>, on_stop: impl FnOnce()) {
let mut stdout = io::stdout().lock();
for key in matches_rx {
let result = self
let cert = self
.key_to_cert(&key)
.and_then(|cert| cert.as_tsk().armored().serialize(&mut stdout));
.expect("should be able to create certificate");
if let Err(err) = result {
eprintln!("Error: {err}");
} else {
self.counter_found.fetch_add(1, Ordering::Relaxed);
self.serialize_cert(cert, &mut stdout)
.expect("should be able to serialize certificate");
let prev = self.counter_found.fetch_add(1, Ordering::Relaxed);
if self.config.stop_after.is_some_and(|s| prev + 1 == s.get()) {
break;
}
}
on_stop();
}
fn key_to_cert(&self, key: &SecretKey) -> anyhow::Result<Cert> {
@@ -157,7 +185,45 @@ impl Fingerprunk {
Cert::try_from(vec![secret_key_packet, Packet::from(sig)])
}
fn serialize_cert(&self, cert: Cert, to: impl io::Write) -> anyhow::Result<()> {
let mut comments = cert.armor_headers();
comments.push(format!(
"Generated with Fingerprunk. Regex: {}",
self.config.regex
));
let headers: Vec<_> = comments
.into_iter()
.map(|s| ("Comment".to_string(), s))
.collect();
let mut writer = armor::Writer::with_headers(to, armor::Kind::SecretKey, headers)?;
// Set the profile to RFC4880 because we generate v4 keys.
writer.set_profile(sequoia_openpgp::Profile::RFC4880)?;
cert.serialize(&mut writer)?;
writer.finalize()?;
Ok(())
}
fn status_displayer_thread(&self) {
const UPDATE_INTERVAL: Duration = Duration::from_millis(250);
eprint!("\n\n\n\n\n");
while !self.stop.load(Ordering::Relaxed) {
self.print_status();
// We are parking the thread instead of sleeping so we can unpark it when we want to
// stop the program.
thread::park_timeout(UPDATE_INTERVAL);
}
self.print_status();
}
fn print_status(&self) {
struct DurationDhms(Duration);
impl fmt::Display for DurationDhms {
@@ -171,28 +237,20 @@ impl Fingerprunk {
}
}
const UPDATE_INTERVAL: Duration = Duration::from_millis(250);
const FORMAT_WIDTH: usize = 12;
let start = Instant::now();
eprint!("\n\n\n\n\n");
loop {
let duration = DurationDhms(start.elapsed());
let keys = self.counter_tried.load(Ordering::Relaxed);
let keys_per_sec = keys as f64 / duration.0.as_secs_f64();
let found = self.counter_found.load(Ordering::Relaxed);
eprint!(
"\x1b[F\x1b[F\x1b[F\x1b[F\x1b[F\
let duration = DurationDhms(self.started_instant.elapsed());
let keys = self.counter_tried.load(Ordering::Relaxed);
let keys_per_sec = keys as f64 / duration.0.as_secs_f64();
let found = self.counter_found.load(Ordering::Relaxed);
eprint!(
"\x1b[F\x1b[F\x1b[F\x1b[F\x1b[F\
Time: {duration}\n\
Tried: {keys: >w$} keys\n\
Rate: {keys_per_sec: >w$.0} keys/s\n\
---\n\
Found: {found: >w$} keys\n",
w = FORMAT_WIDTH
);
thread::sleep(UPDATE_INTERVAL);
}
w = FORMAT_WIDTH
);
}
}
+9 -1
View File
@@ -1,4 +1,7 @@
use std::io::{self, IsTerminal};
use std::{
io::{self, IsTerminal},
num::NonZeroU64,
};
use anyhow::{Context as AnyhowContext, anyhow};
use clap::{ArgAction, Parser, ValueEnum};
@@ -26,6 +29,10 @@ struct Args {
#[arg(long, value_enum, default_value_t)]
status: StatusEnabled,
/// Stop once the specified number of matching keys has been found.
#[arg(long)]
stop_after: Option<NonZeroU64>,
/// Prompt for a password and use it to encrypt found keys.
///
/// By default, found keys are printed to stdout unencrypted. Use this if you actually plan to
@@ -78,6 +85,7 @@ fn main() -> anyhow::Result<()> {
let config = fingerprunk::Config {
regex: args.regex,
status_enabled: args.status.evaluate(),
stop_after: args.stop_after,
password,
};