man 5 shadow says this about the 2nd field:
Is that true nowadays? I think it should say "hashed password". Am I correct?
No, the shadow file does not contain encrypted passwords, not on any Unix variant that I've seen. That would require an encryption key somewhere — where would it be?
Even the original version of the
crypt function was in fact a hash function. It operated by using the password as a key for a variant of DES. The output of
crypt is the encryption of a block with all bits zero. Although this uses an encryption function as part of the implementation, the
crypt operation is not an encryption operation, it is a hash function: a function whose inverse is hard to compute and such that it is difficult to find two values producing the same output.
Within its limitations, the original DES-based
crypt implementation followed the basic principles of a good password hash function: irreversible function, with a salt, and a slow-down factor. It's the limitations, not the design, that make it unsuitable given today's computing power: maximum of 8 characters in the password, total size that makes it amenable to brute force, salt too short, iteration count too short.
Because of the
crypt name (due to the fact that
crypt uses encryption internally), and because until recently few people were educated in cryptography, a lot of documentation of the
crypt function and of equivalents in other environments describes it as “password encryption”. But it is in fact a password hash, and always has been.
Modern systems use password hashing functions based on more robust algorithms. Although some of these algorithms are known as “MD5”, “SHA-256” and “SHA-512”, the hash computation is not something like MD5(password + salt) but an iterated hash which meets the slowness requirement (though common methods lack the memory hardness that protects against GPU-based acceleration).
man 5 shadow section 'encrypted password' refers to
crypt(3). If you read that manual (
man 3 crypt) you will see that both legacy DES encrypted passwords as currently used hash algorithms can be used. Therefore you are right that 'encrypted password' does not fully covers what the field may contain. A better description should be 'encrypted or hashed password'
It depends on the settings. A shadow file can still contain an encrypted (with itself and a salt) password, but it depends on the form if it is hashed or not.
Your system probably makes the entry for new passwords based on a hash function, but the old format is most likely still supported.
If the entry doesn't start with a
$ it is assumed to be output from
crypt if not one of the supported hash function has been used.
From the wikipedia entry on the shadow file:
"$1$" stands for MD5, "$2a$" is Blowfish, "$2y$" is Blowfish (correct handling of 8-bit chars), "$5$" is SHA-256 and "$6$" is SHA-512,