man 5 shadow
says this about the 2nd field:
encrypted password
Is that true nowadays? I think it should say "hashed password". Am I correct?
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this communityman 5 shadow
says this about the 2nd field:
encrypted password
Is that true nowadays? I think it should say "hashed password". Am I correct?
No, the shadow file does not contain encrypted passwords, not on any Unix variant that I've seen. That would require an encryption key somewhere — where would it be?
Even the original version of the crypt
function was in fact a hash function. It operated by using the password as a key for a variant of DES. The output of crypt
is the encryption of a block with all bits zero. Although this uses an encryption function as part of the implementation, the crypt
operation is not an encryption operation, it is a hash function: a function whose inverse is hard to compute and such that it is difficult to find two values producing the same output.
Within its limitations, the original DES-based crypt
implementation followed the basic principles of a good password hash function: irreversible function, with a salt, and a slow-down factor. It's the limitations, not the design, that make it unsuitable given today's computing power: maximum of 8 characters in the password, total size that makes it amenable to brute force, salt too short, iteration count too short.
Because of the crypt
name (due to the fact that crypt
uses encryption internally), and because until recently few people were educated in cryptography, a lot of documentation of the crypt
function and of equivalents in other environments describes it as “password encryption”. But it is in fact a password hash, and always has been.
Modern systems use password hashing functions based on more robust algorithms. Although some of these algorithms are known as “MD5”, “SHA-256” and “SHA-512”, the hash computation is not something like MD5(password + salt) but an iterated hash which meets the slowness requirement (though common methods lack the memory hardness that protects against GPU-based acceleration).
man 5 shadow
section 'encrypted password' refers to crypt(3)
. If you read that manual (man 3 crypt
) you will see that both legacy DES encrypted passwords as currently used hash algorithms can be used. Therefore you are right that 'encrypted password' does not fully covers what the field may contain. A better description should be 'encrypted or hashed password'
crypt
implementation did not encrypt the password, it hashed it.
Jun 12, 2015 at 15:50
It depends on the settings. A shadow file can still contain an encrypted (with itself and a salt) password, but it depends on the form if it is hashed or not.
Your system probably makes the entry for new passwords based on a hash function, but the old format is most likely still supported.
If the entry doesn't start with a $
it is assumed to be output from crypt
if not one of the supported hash function has been used.
From the wikipedia entry on the shadow file:
"$1$" stands for MD5, "$2a$" is Blowfish, "$2y$" is Blowfish (correct handling of 8-bit chars), "$5$" is SHA-256 and "$6$" is SHA-512,
crypt
implementation used an encryption function under the hood (but it did not encrypt the password), but crypt
itself was a hash function, not an encryption function.
Jun 12, 2015 at 15:49