john-users - Re: about salts

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / community lists wiki CVSweb mirrors signatures
bringing security into open environments

This website is powered by Openwall GNU/*/Linux security-enhanced OS

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Tue, 04 Apr 2006 23:07:47 -0500
From: Dennis Olvany <dennisolvany@...il.com>
To:  john-users@...ts.openwall.com
Subject: Re: about salts

> Salts are typically picked at random.

Would it not make sense to store the salts separately from the
passwords? Would it not be more difficult to crack the passwords without
the salts?

> With the traditional crypt(3), the first 2 characters of the
> 13-character encoding are the salt (12 bits, for 4096 possibilities).
> 
The first two characters are salts in the plain, no? The hashes are
ascii-encoded, no? I thought 2 ascii characters would be 16 bits.

>> (Traditional DES [24/32 4K])

What the heck are these numbers, by the way.

> This output also tells me one other thing - you're probably using a 
> non-MMX build of John on an x86 processor.

Cool. Got the mmx version installed now.