Weekly edition	Kernel	Security	Distributions	Contact Us	Search
Archives	Calendar	Subscribe	Write for LWN	LWN.net FAQ	Sponsors

Rainbow tables for password cracking

Posted Nov 17, 2006 4:14 UTC (Fri) by jake (editor, #205)
In reply to: Rainbow tables for password cracking by zaitseff
Parent article: Rainbow tables for password cracking

> Unfortunately, it seems as if all of my many Debian-based systems use "1" as the salt.

No, the salt is actually between the next 2 dollar signs ... $1$salt$hash

$1$ indicates the format of the password ...

hope that helps!

jake

(Log in to post comments)

Rainbow tables for password cracking

Posted Nov 18, 2006 14:39 UTC (Sat) by jond (subscriber, #37669) [Link]

Very interesting. Forgive my ignorance, but how is the hash then stored? I use md5 passwords (at least I told the installer to do so ;).

If I setup a temp user with password Ior3yaeW, I get the following:

temp:$1$.K4dEqjn$pHNfFwq4BAUHf7TcUScuJ1:13470:0:99999:7:::

so if I echo Ior3yaeW.K4dEqjn | md5sum ; what do I do to _that_ to get pHNfFwq4BAUHf7TcUScuJ1 ?

Rainbow tables for password cracking

Posted Nov 22, 2006 1:33 UTC (Wed) by dmenest (guest, #4017) [Link]

The MD5 password hash is a lot more complicated than a simple MD5 hash. In fact, the code to generate the password hash calls the simple MD5 hash routine more than 1000 times. So you won't be able to do it easily on the command line without a program that calls the crypt() function for you.