Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I get some hash like:

username         sowainformix
salt             7307821250330563328
hashed_password  HaHvvzanjp_lPZgHLu0KHquN.Q4t98EF48csXk1QTJs
hash_type        SHA-256
updated
flags            2
min_change
max_change
inactive
ac_expire

who can tell me some infomation about the algorithm of Informix,that I should do the weak password check about some Informix device. thanks.

share|improve this question
1  
hash_type== sha-256 there is the hashing algorithm used, not sure exactly how they are appending salt, but trying various common methods would probaby gain that information. Finally, the output looks like it is base64 encoded. –  ewanm89 May 27 '13 at 9:38
    
thanks,I will try some combination of algorithm. –  zirong May 27 '13 at 10:01

2 Answers 2

The hash is generated by SHA-256 of the password and salt, encoded as a Base64 string with a custom character set. I discovered this by replacing the invalid characters (_ and .) with an A and decoding it, and the result comes out at exactly 256 bits. Of course, the result data is wrong due to not knowing the encoding, but the size remains correct.

This is backed up by their documentation, which says the following about the users table:

  • username - NCHAR(32) - Name for the user.
  • salt - BIGINT - 64-bit salt that the server uses to morph the password before applying the hashing algorithm. The server can use salt to change a password so that two users with the same password do not have the same hashed password in the database. Salt improves security because it prevents password guessing.
  • hashed_password - VARCHAR(128) - A sha-256 hashed and base-64 encoded password.
  • hash_type - CHAR(16) - Type of hashing algorithm used. Currently the SHA-256 algorithm is used.
  • updated - DATETIME YEAR TO SECOND {TIMESTAMP} - N/A
  • flags - INTEGER - Flags used to store some account information (such as the account lock).
  • min_change - INTERVAL DAY(7) TO SECOND - N/A
  • max_change - INTERVAL DAY(7) TO SECOND - N/A
  • inactive - INTERVAL DAY(7) TO SECOND - N/A
  • ac_expire - DATETIME YEAR TO SECOND - N/A

Unfortunately there's no easy way to tell how the hash is computed from the password and salt, or what base64 character set they use. It doesn't seem to be documented. You'd probably have to install Informix and reverse engineer this manually.

share|improve this answer
    
thanks a lot.I kown the password of the Informix,so if I get the algorithm I can use my dictionary to check the weak password.Thanks. –  zirong May 27 '13 at 9:58

the algorithm is described here: http://sourceforge.net/p/jbrute/blog/2013/10/jbrute-labs-a-little-of-cryptoanalysis-over-informixs-password-algorithm/

Cheers.

share|improve this answer
2  
While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. –  TildalWave Oct 20 '13 at 6:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.