Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm trying to understand how Linux hashes their passwords, so to get started lets say I do this openssl passwd -1 -salt xyz test. This will output: $1$xyz$jAlmRpcFe.aiPOIXET9GG/. Now what I do understand:
$1$ is the md5 algorithmxyz$ is the salt used with a $ sign appended to itjAlmRpcFe.aiPOIXET9GG/ is the actual password hashed with md5 and something else.The last part is what I do not understand, what else is this hashed computed with?
Poul-Henning Kamp designed a baroque and (at the time) computationally expensive algorithm based on the MD5 message digest algorithm. ...
First the passphrase and salt are hashed together, yielding an MD5 message digest. Then a new digest is constructed, hashing together the passphrase, the salt, and the first digest, all in a rather complex form. Then this digest is passed through a thousand iterations of a function which rehashes it together with the passphrase and salt in a manner that varies between rounds. The output of the last of these rounds is the resulting passphrase hash.
That's tells you it's not just doing a (single) hash of pw+salt, but it isn't very exact. Fortunately OpenSSL is open source, so https://github.com/openssl/openssl/blob/master/apps/passwd.c#L322 (or apps/passwd.c in any copy of any version of the source which has been available for decades) shows you the exact algorithm. It is indeed baroque, more so than I care to try to explain unless you have a specific question about it.
base64encoded string. If I hashed the salt with the password I'd get something that looks like this:c1c04d145fb30e2203943ea4f6fed1d4now if I encode it tobase64:YzFjMDRkMTQ1ZmIzMGUyMjAzOTQzZWE0ZjZmZWQxZDQ=it's not the same thing.. – mawi Aug 11 '17 at 21:58