I know that the /etc/shadow file hash follows this syntax: $id$salt$encrypted

The $id identifies the algorithm being used, e.g.:

  • $0 - DES
  • $1 - MD5
  • $2a - Blowfish
  • $5 - SHA-256
  • $6 - SHA-512

Here is an entry of my shadow file:


I'm running the most up-to-date Kali Linux version (for 2014), which is based on Debian "wheezy", which in turn uses SHA-512, hence $6.

The problem I am having is that I went to an online service, which calculates and "reverse-calculates" SHA hashes and input my password ("root") there. The hash they showed me did not match the hash in my /etc/shadow-file, and when I entered my hash from the file to search against their database, they claimed the format was invalid.

I know that using a salt would affect the hash in some way, but as far as I can tell, my hash does not use a salt, as it follows the format $id$hash, not $id$salt$hash.

As such, I would like to ask the following:

  • Why does my hash not look like a "normal" SHA-512 hash?
  • What kind of hash is this, if it is not "normal" SHA-512?
  • Can I recognize the type of hash by only looking at the $id?

closed as off-topic by schroeder May 22 at 8:56

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • There is clearly a salt in the shadow entry. – schroeder May 22 at 9:01

The site you linked to calculates plain SHAs and outputs in hex, not salted SHAs with multiple rounds output in base64, so it's basically impossible to compare them.

In your shadow entry, splitting on $ you have 6, which is type SHA512, 89Zi5dxn, which is the salt, and then RvKDsJQhBiX2K3CEVUE3nQxvdBV.3vDK4Jrn11xC8jO31c43VnZeTL1OGaJWfFkl9di8nfreAXFLreCuQDshf1, which is a base64-encoded hash.

In addition to the salting, libc applies a number of rounds of the hash, defaulting to 5000. If you want the details on how a crypt() style SHA512 is calculated, here's a link to the source: https://github.com/lattera/glibc/blob/master/crypt/sha512-crypt.c

Not the answer you're looking for? Browse other questions tagged or ask your own question.