3

How does Linux know if a new password is a "wrapped" version of an old password? (or, the process of creating a new password) know "certain" parts of one's password?

Let's say I have the password abcEFGH123321 and I set a new password to be: acbdEFGH123321 (added a d). it displays:

new password is a wrapped version of the/an old password

My guess

..is that the whatever application handling the setting & reading new & old account / sudo passwords maybe hashes X amount of the first bits of the entered password,

For example;

Say the password abcd is set, via passwd (e.g) and, you change it (the password)

abcd to abdc (swapping the last 2 characters).

Does it maybe take the old password: abcd and hash the first 3 characters of it?

H₁ -> H('a') -> stores it
H₂ -> H('b') -> stores it

and so on, for - x times. (in this case, maybe x is a hard-coded constant , 3 for example)

If it stores this:

Where does it?

Where does it store the "parts"? Note I am not asking in general - if it knows this - But rather how it does it. An explanation answer- with references would be great!

Improve this question
7
  • 1
    Or maybe it just tries wrapped versions of the newly entered password and checks if a hashed version of it just matches the existing password? Because "new is wrapped old password" is the same as "old is wrapped new one". Nothing to save for this.
    – Steffen Ullrich
    Mar 16, 2021 at 18:52
  • @SteffenUllrich That could really be a way too.. I did not think about that at all, actually
    – William Martens
    Mar 16, 2021 at 18:53
  • 1
    I suppose it could detect abcEFGH123321 --> abcdEFGH123321 through trial hashing (ie try something and hash it to see if that matches the stored hash), by deleting each single letter and trying it. But if it's doing that, would it also need to try CAPS'ing each letter? l33t subs? Adding / removing random punctuation at the end? That would quickly add up to a lot of computation...
    – Mike Ounsworth
    Mar 16, 2021 at 19:11
  • 2
    What versions of the software are running on your system? The cracklib library that most distributions use will compare the old and new passwords when you supply them (when just using passwd and supplying the old password). I don't see any libraries that will actually work on the new password to try and find previous hashes.
    – user
    Mar 16, 2021 at 19:24
  • 1
    I think it's simply taking each substring of the newly-entered password, and hashing each one to see any match the hash of the current password. If a password is 12 characters long, there are 364 possible substrings - the user would probably not even notice a delay on most systems.
    – mti2935
    Mar 16, 2021 at 20:45

1 Answer 1

Reset to default
6

The answer is cracklib.

CrackLib will take the new password and modify it in a lot of ways to see if the modification is the same as the current password, that you had to type before changing the password.

So if your old password is acbEFGH123321 and the new is acbdEFGH123321, and Linux complains, it means cracklib took the new password, added/dropped chars on each position, and discovered that you added one single letter. And that's bad.

Performance penalty on this is negligible. Linux have both the old and the new passwords, and a simple compare between strings can detect differences.

Improve this answer
11
  • 1
    +1. WRT 'Linux have both the old and the new passwords, and a simple compare between strings can detect differences' - you mean that linux has the salted hash of the old password, correct? So, it's a little more than just a string comparison, as each modification of the new password must be salted and hashed in order to compare it with the salted hash of the old password. But, still negligible for a reasonable number of modifications.
    – mti2935
    Mar 16, 2021 at 22:43
  • 6
    No, you have to provide the old password before entering the new one, so Linux has both passwords in clear.
    – ThoriumBR
    Mar 17, 2021 at 0:00
  • 1
    Ah, good point.
    – mti2935
    Mar 17, 2021 at 0:32
  • 2
    As a remark, it is the reason why this limits do not apply when the change is done by the super user, because the new password is entered but the old one is not.
    – Serge Ballesta
    Mar 18, 2021 at 11:12
  • 1
    @SergeBallesta I don't think that's really true. Even without knowing the old password, the passwd command could still (try to) prevent root from setting a 2 character password. But it doesn't. I think the real reason is for that behavior when running as root is: so one can do whatever one wants to do with a computer that one is root on, without needing to fight too much with a utility program which (was written by a company which) knows better than you.
    – jrw32982
    Mar 22, 2021 at 19:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.