2

I'm trying to understand how Linux hashes their passwords, so to get started lets say I do this openssl passwd -1 -salt xyz test. This will output: $1$xyz$jAlmRpcFe.aiPOIXET9GG/. Now what I do understand:

  • $1$ is the md5 algorithm
  • xyz$ is the salt used with a $ sign appended to it
  • jAlmRpcFe.aiPOIXET9GG/ is the actual password hashed with md5 and something else.

The last part is what I do not understand, what else is this hashed computed with?

  • 1
    It's hashed with the salt. That's what it's for – Beat Aug 11 '17 at 21:38
  • ^^ Too bad you can't Accept a comment. – Mike Ounsworth Aug 11 '17 at 21:51
  • @Beat that doesn't explain how they get to the base64 encoded string. If I hashed the salt with the password I'd get something that looks like this: c1c04d145fb30e2203943ea4f6fed1d4 now if I encode it to base64: YzFjMDRkMTQ1ZmIzMGUyMjAzOTQzZWE0ZjZmZWQxZDQ= it's not the same thing.. – mawi Aug 11 '17 at 21:58
2

As wikipedia says

Poul-Henning Kamp designed a baroque and (at the time) computationally expensive algorithm based on the MD5 message digest algorithm. ...
First the passphrase and salt are hashed together, yielding an MD5 message digest. Then a new digest is constructed, hashing together the passphrase, the salt, and the first digest, all in a rather complex form. Then this digest is passed through a thousand iterations of a function which rehashes it together with the passphrase and salt in a manner that varies between rounds. The output of the last of these rounds is the resulting passphrase hash.

That's tells you it's not just doing a (single) hash of pw+salt, but it isn't very exact. Fortunately OpenSSL is open source, so https://github.com/openssl/openssl/blob/master/apps/passwd.c#L322 (or apps/passwd.c in any copy of any version of the source which has been available for decades) shows you the exact algorithm. It is indeed baroque, more so than I care to try to explain unless you have a specific question about it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.