smd5 - generate by unix tool or perl

Question

I have problem on Unix, have to create a lot of passwords in smd5 but don't know how to generate smd5 passwords using some unix tool or perl in a form: {smd5}DoZgZ.OE$vSg4ZH7Bpy0BCdXNzBj001

I have never had any problems to generate anything on linux in md5/sha256/sha512 with tools like e.g. openssl

I have tried with Perl using something like that:

use Digest::MD5;
use MIME::Base64;
$ctx = Digest::MD5->new;
$ctx->add('vwkfA17aF`');
$salt = 'DoZgZ.OE';
$ctx->add($salt);
$hashedPasswd = '{smd5}' . encode_base64($ctx->digest . $salt ,'');
print $hashedPasswd . "\n";

but unfortunatelly output is quite different : {smd5}5zJphaZULO3gnT1pwT1YHERvWmdaLk9F I do not see salt there like here {smd5}DoZgZ.OE$vSg4ZH7Bpy0BCdXNzBj001 and string is longer

Answer 1

AIX's {smd5} format is a non-standard one. It's a minor variant of the *BSD/Linux/Solaris “MD5” (which is the one generated by openssl passwd -1). I wasn't able to find much information about it. There is code contributed to John the Ripper (present in the 1.8.0 jumbo version) that calculates it, in the file aix_smd5_fmt_plug.c. From reading the code, it seems that the difference is that the BSD MD5 variant effectively prepends the string $1$ to the salt in one place, whereas the AIX variant doesn't. It shouldn't be very hard to patch OpenSSL to support this variant if you know C.

You can change the algorithm used by AIX by editing /etc/security/pwdalg.cfg and add the line lpa_options = std_hash=true in the smd5: stanza. The normal way to do that is with the chsec command:

chsec -f /etc/security/pwdalg.cfg -s md5 -a std_hash=true

As far as I understand, this invalidates passwords recorded with the non-standard algorithm.

Note that LDAP salted MD5 is not a good password hash, because it isn't slow. How to securely hash passwords? explains what that means. The BSD and AIX “MD5” algorithms are slow (to ideally slow, but way better than non-slow algorithms).