Date: Wed, 6 Sep 2006 18:04:20 +0400 From: Solar Designer <solar@...nwall.com> To: john-users@...ts.openwall.com Subject: hashing, not encryption; salts On Thu, Aug 31, 2006 at 05:23:34PM -0400, John wrote: > Now one more question: I understand the basic principle behind taking a > dictionary work, or a string that JTR has created, encrypting that string, > and then matching it against an encrypted hash. Using that same encryption > algorithm, if the hashes match then that is your password. This is about right, except that you're missing the distinction between encryption and hashing. If you find yourself trying to write "encrypt", "encryption", "encrypted", etc. in this context, you're most likely using the wrong terms. "An encrypted hash" is the most confusing because it is in fact reasonable to encrypt hashes in some special cases (e.g., this is done on Windows systems with SYSKEY) - but you did not mean that. > But how does JTR do this with salted hashes? How does JTR figure out what > salt was used ... Salts are typically stored along with the hashes. For example, with traditional Unix password hashes, the first two characters of the 13-character encodings are the salts. P.S. I've changed the Subject now, but did not break the thread. You should have done so before asking your "one more question" - to make sure that the Subject reflects your new question. And you shouldn't have quoted that much context (you've even quoted the unsubscription notice)... Please note this for your future postings. Thanks, -- Alexander Peslyak <solar at openwall.com> GPG key ID: 5B341F15 fp: B3FB 63F4 D7A3 BCCC 6F6E FC55 A2FC 027C 5B34 1F15 http://www.openwall.com - bringing security into open computing environments Was I helpful? Please give your feedback here: http://rate.affero.net/solar -- To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Powered by Openwall GNU/*/Linux - Powered by OpenVZ