7

man 5 shadow says this about the 2nd field:

encrypted password

Is that true nowadays? I think it should say "hashed password". Am I correct?

Improve this question
2

3 Answers 3

Reset to default
10

No, the shadow file does not contain encrypted passwords, not on any Unix variant that I've seen. That would require an encryption key somewhere — where would it be?

Even the original version of the crypt function was in fact a hash function. It operated by using the password as a key for a variant of DES. The output of crypt is the encryption of a block with all bits zero. Although this uses an encryption function as part of the implementation, the crypt operation is not an encryption operation, it is a hash function: a function whose inverse is hard to compute and such that it is difficult to find two values producing the same output.

Within its limitations, the original DES-based crypt implementation followed the basic principles of a good password hash function: irreversible function, with a salt, and a slow-down factor. It's the limitations, not the design, that make it unsuitable given today's computing power: maximum of 8 characters in the password, total size that makes it amenable to brute force, salt too short, iteration count too short.

Because of the crypt name (due to the fact that crypt uses encryption internally), and because until recently few people were educated in cryptography, a lot of documentation of the crypt function and of equivalents in other environments describes it as “password encryption”. But it is in fact a password hash, and always has been.

Modern systems use password hashing functions based on more robust algorithms. Although some of these algorithms are known as “MD5”, “SHA-256” and “SHA-512”, the hash computation is not something like MD5(password + salt) but an iterated hash which meets the slowness requirement (though common methods lack the memory hardness that protects against GPU-based acceleration).

Improve this answer
3
  • 2
    You are saying that if you encrypt some data X with key Y into Z and destroy Y (and possible X) then Z is no longer encrypted data. That you no longer can decrypt something because you don't have the key doesn't make something that was encrypted no longer be encrypted.
    – Anthon
    Jun 12, 2015 at 16:31
  • 4
    @Anthon No. I am saying that if you encrypt some data X with key Y into Z, you are not encrypting Y.
    – Gilles 'SO- stop being evil'
    Jun 12, 2015 at 16:48
  • In your last paragraph "[it isn't] MD5(password+hash)" doesn't make sense to me; did you mean "it isn't merely MD5(password+**salt**)" ?
    – dave_thompson_085
    Jun 23, 2015 at 15:54
6

man 5 shadow section 'encrypted password' refers to crypt(3). If you read that manual (man 3 crypt) you will see that both legacy DES encrypted passwords as currently used hash algorithms can be used. Therefore you are right that 'encrypted password' does not fully covers what the field may contain. A better description should be 'encrypted or hashed password'

Improve this answer
3
  • 1
    It's not just that “encrypted password” doesn't follow the field, it's simply inaccurate. I've never seen a Unix system with encrypted passwords, and the original crypt implementation did not encrypt the password, it hashed it.
    – Gilles 'SO- stop being evil'
    Jun 12, 2015 at 15:50
  • So am I correct that "encrypted" term is not right? Unless this term had been changed during "unixes" history...
    – sebelk
    Jun 12, 2015 at 16:32
  • 2
    @sebelk Yes, “encrypted” is an entrenched, but incorrect term.
    – Gilles 'SO- stop being evil'
    Jun 12, 2015 at 16:49
2

It depends on the settings. A shadow file can still contain an encrypted (with itself and a salt) password, but it depends on the form if it is hashed or not.

Your system probably makes the entry for new passwords based on a hash function, but the old format is most likely still supported.

If the entry doesn't start with a $ it is assumed to be output from crypt if not one of the supported hash function has been used.

From the wikipedia entry on the shadow file:

"$1$" stands for MD5, "$2a$" is Blowfish, "$2y$" is Blowfish (correct handling of 8-bit chars), "$5$" is SHA-256 and "$6$" is SHA-512,

Improve this answer
2
  • 1
    On what system have you seen an encrypted password? If it's encrypted, it means there's an encryption (and decryption) key somewhere. The original DES-based crypt implementation used an encryption function under the hood (but it did not encrypt the password), but crypt itself was a hash function, not an encryption function.
    – Gilles 'SO- stop being evil'
    Jun 12, 2015 at 15:49
  • What crypt does with DES is what I meant in my answewer by encrypting with itself, without knowing the password there was no way to decrypt and if you knew you did not need to decrypt in the first place.
    – Anthon
    Jun 12, 2015 at 15:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .