I get some hash like:

username         sowainformix
salt             7307821250330563328
hashed_password  HaHvvzanjp_lPZgHLu0KHquN.Q4t98EF48csXk1QTJs
hash_type        SHA-256
flags            2

Who can tell me some information about the algorithm of Informix, that I should do the weak password check about some Informix device? Thanks.

  • 1
    hash_type== sha-256 there is the hashing algorithm used, not sure exactly how they are appending salt, but trying various common methods would probaby gain that information. Finally, the output looks like it is base64 encoded. – ewanm89 May 27 '13 at 9:38

The hash is generated by SHA-256 of the password and salt, encoded as a Base64 string with a custom character set. I discovered this by replacing the invalid characters (_ and .) with an A and decoding it, and the result comes out at exactly 256 bits. Of course, the result data is wrong due to not knowing the encoding, but the size remains correct.

This is backed up by their documentation, which says the following about the users table:

  • username - NCHAR(32) - Name for the user.
  • salt - BIGINT - 64-bit salt that the server uses to morph the password before applying the hashing algorithm. The server can use salt to change a password so that two users with the same password do not have the same hashed password in the database. Salt improves security because it prevents password guessing.
  • hashed_password - VARCHAR(128) - A sha-256 hashed and base-64 encoded password.
  • hash_type - CHAR(16) - Type of hashing algorithm used. Currently the SHA-256 algorithm is used.
  • flags - INTEGER - Flags used to store some account information (such as the account lock).
  • min_change - INTERVAL DAY(7) TO SECOND - N/A
  • max_change - INTERVAL DAY(7) TO SECOND - N/A
  • inactive - INTERVAL DAY(7) TO SECOND - N/A
  • ac_expire - DATETIME YEAR TO SECOND - N/A

Unfortunately there's no easy way to tell how the hash is computed from the password and salt, or what base64 character set they use. It doesn't seem to be documented. You'd probably have to install Informix and reverse engineer this manually.

  • thanks a lot.I kown the password of the Informix,so if I get the algorithm I can use my dictionary to check the weak password.Thanks. – zirong May 27 '13 at 9:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.