🚀 go-pugleaf

Julien Goodwin <laptop006@gemini.chriskaine.com.au> writes:

>On Mon, 16 Jun 2008 18:33:28 GMT, The Doctor wrote:
>> Apart from MD5, what are the other unix/linux password encrption schemes
>Note, they're not encrypted, but hashed, an important distinction.

>> used on /etc/passwd or /etc/shadow?

>There's the old DES crypt(3), some systems support SHA1, but otherwise
>MD5 is it. There's really no known issues with it at the moment, the
>only way MD5 is really "broken" is that it's possible to create an
>arbitary hash if you're able to add random crap to the end.

What is used is NOT MD5 anymore than what was used in the old crypt was
des. It uses md5 many many times, but surrounds it with a bunch of other
incoherent junk. The attempt was to make something that would take a while
to run, making attemtps to do password searches longer.
Weaknesses of md5 itself have absolutely nothing to say about the password
hash. The password hash might be much weaker or much stronger than md5.It
has AFAIK never been analysed.


>> What is a good introduction website on them?
>http://en.wikipedia.org/wiki/Crypt_(Unix)
>http://en.wikipedia.org/wiki/Shadow_password
>http://www.openwall.com/passwords/unix-crypt

>Julien