Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 6 Sep 2006 18:04:20 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: hashing, not encryption; salts

On Thu, Aug 31, 2006 at 05:23:34PM -0400, John wrote:
> Now one more question:  I understand the basic principle behind taking a
> dictionary work, or a string that JTR has created, encrypting that string,
> and then matching it against an encrypted hash. Using that same encryption
> algorithm, if the hashes match then that is your password.

This is about right, except that you're missing the distinction between
encryption and hashing.  If you find yourself trying to write "encrypt",
"encryption", "encrypted", etc. in this context, you're most likely
using the wrong terms.  "An encrypted hash" is the most confusing
because it is in fact reasonable to encrypt hashes in some special cases
(e.g., this is done on Windows systems with SYSKEY) - but you did not
mean that.

> But how does JTR do this with salted hashes?  How does JTR figure out what
> salt was used ...

Salts are typically stored along with the hashes.  For example, with
traditional Unix password hashes, the first two characters of the
13-character encodings are the salts.

P.S. I've changed the Subject now, but did not break the thread.  You
should have done so before asking your "one more question" - to make
sure that the Subject reflects your new question.  And you shouldn't
have quoted that much context (you've even quoted the unsubscription
notice)...  Please note this for your future postings.

Thanks,

-- 
Alexander Peslyak <solar at openwall.com>
GPG key ID: 5B341F15  fp: B3FB 63F4 D7A3 BCCC 6F6E  FC55 A2FC 027C 5B34 1F15
http://www.openwall.com - bringing security into open computing environments

Was I helpful?  Please give your feedback here: http://rate.affero.net/solar

-- 
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.

Powered by blists - more mailing lists

Your e-mail address:

Powered by Openwall GNU/*/Linux - Powered by OpenVZ