0

I've created a mysql dump of my users and passwords and awked them into a presentable form:

Passwords:

'6cc5db1c282daa071b0cf80982d19ec0f2e21976a4c39c0c7a3ab30f102b33e2780fd56f4d507e4873630eeb5ba1a8ad8d338bb8abcf64a513630a0dea7044db'
'1927f6acb76f53106a29015ba787e6f7c826f939a64be656a669f78515ffbb2447bee266e5f57751d98f4990f71d131bcb11575199b8e717a0ad91c381df43ca'
'dfd3b2e6478c0ca15102e74251a300abba96296662686f9eeba1f2ebbb9353ad9f91546d0c02ececd5e205c0a94e083a3f63eeec9642f69ad24fd674927c6a3d'

Salts:

'ecb2796f-e69d-4ad6-858f-832170b00b5c'
'a46a3486-79dd-428b-88a8-558303fe8dc8'
'02b6fedc-6932-4893-8725-cd4c8a191d57'

With the first entry on one corresponding to the first on the other. The password for the first entry is password. I am using sha512whirlpool as the hashing algorithm.

I want to use a utility to hash a string ("password" in this case) using that same algorithm and salting it and compare it to the hashed password. Anyone have any ideas what utility might be good for this? I was hoping to use mkpasswd, but I got an error there:

mkpasswd -m sha-512 password ecb2796f-e69d-4ad6-858f-832170b00b5c

And this is the error:

Wrong salt length: 36 bytes when 8 <= n <= 16 expected.

Was I doing something wrong here? Any advice?

Note: I've transferred the question here from stack overflow.

6
  • Try repeating the command with the dashes removed from your salts. I'm not sure that will completely fix the error but they aren't needed unless mkpasswd is expecting them.
    – PwdRsch
    Mar 8, 2016 at 20:16
  • Same result: Wrong salt length: 32 bytes when 8 <= n <= 16 expected. Mar 8, 2016 at 20:17
  • 2
    Please, Please, fix your terminology. You're not "encrypting" the passwords (which would be a reversable process), but rather you're hashing them.
    – SEJPM
    Mar 8, 2016 at 20:30
  • An answer over here implies you need a flag before your salt. But your error suggests mkpasswd is already interpreting that value as the salt, so this may also not solve the issue.
    – PwdRsch
    Mar 8, 2016 at 20:30
  • Duplicate of this question on SO.
    – zaph
    Mar 8, 2016 at 20:37

1 Answer 1

5

SHA-512 and Whirlpool are two distinct hash functions, so one has to assume that you are using one of them, not both. There is no hash function called "sha512whirlpool"; this would be a most unholy hybrid.

Cryptographic hash functions do not use salts. Password hashing functions are complicated constructions that may be built with cryptographic hash functions, or other elements. mkpasswd is a command-line interface for the C library function crypt() (which deals with password hashing and not at all with encryption, despite its name). On Linux systems, crypt() supports a number of password hashing constructions, one of them using SHA-512 repeatedly, mixing in the password and the salt at various steps. This is in no way the only password hashing construction from an underlying hash function, so there is no guarantee that the examples you have at hand really used that function.

Password hashing constructions tend to work over bytes, for both the salt and the password. But humans like to read characters. There is thus some translation between the two, and, there again, there is no universal convention. Your salts, like "ecb2796f-e69d-4ad6-858f-832170b00b5c", are reminiscent of the traditional string encoding of UUID. An UUID is a 128-bit identifier, i.e. a sequence of 16 bytes, but the character representation uses hexadecimal with a few extra dashes, for a total of 36 characters. When you invoke mkpasswd, that tool tries to convert the provided salt string not by interpreting it as an UUID in hexadecimal-with-dashes, but by mapping each character to its ASCII code, thus transforming the 36-character string into a 36-byte salt. It then chastises you for providing a 36-byte salt, while the internal function expects a salt of legnth 8 to 16 bytes only.

Since the mkpasswd command-line tool expects the salt as a "string", passing arbitrary bytes may be complicated in case you want to provide bytes that do not map to printable characters. The crypt() function itself expects a salt that consists of non-zero bytes. You may have to resort to programming...

1
  • Thank you for your help. This was the answer I was looking for. Mar 10, 2016 at 1:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .