I'm trying to understand how typical Linux distributions generate the password field for entries in
/etc/shadow. I can't figure out what encryption algorithm is being used to produce the encrypted password string.
From what I understand, the first value
1 signifies that an MD5 hashing method was used with the second value
CQoPk7Zh as the salt. However, what was the encryption algorithm used to produce the final encrypted password string
The Linux man page for crypt(3) has a note for glibc2:
If salt is a character string starting with the characters "$id$" followed by a string terminated by "$":
then instead of using the DES machine, id identifies the encryption method used and this then determines how the rest of the password string is interpreted.
I think the semantics are throwing me off: the manual says id specifies the encryption method, but it's specifying the hashing method.
I believe the process is working like this:
password ==> MD5(password+salt) ==> hash ==> encryption-algorithm(hash) ==> encrypted-pass
So how do I determine the encryption algorithm? Specifically, what encryption algorithm is used when the id is