How does Grub's MD5 algorithm work? When you run grub-md5-crypt and enter the same password each time you get different results. Generally md5 is supposed to always return the same hash, so why does grub's version return something different each time?

Also, considering that, how is it then determining you are entering the correct password? If you each encryption creation with the same password generates a different hash, then how is it that later on when you enter your password (and theoretically the same algorithm is used) that since the hash's will be different, how are they matched to show you provided the correct password?

I'm assuming a salt is used somewhere and that the salt is randomly generated, but what is the salt, and how is it generated exactly, and then how is it replicated?

  • How long is the result? Maybe it's salted. MD5 should be 16 bytes long.
    – Kerrek SB
    Sep 29 '11 at 19:25
  • 2
    Sounds like this might be a better question for linux.stackexchange.com.
    – Matt Ball
    Sep 29 '11 at 19:26
  • Didn't know linux.stackexhchange.com existed. I'll try there as well. Thanks!
    – Aram Papazian
    Sep 29 '11 at 22:01

The grub source code is the best place to find out. The necessary logic is in stage2/md5.c in:

int md5_password (const char *key, char *crypted, int check)

It produces strings of the form: $1$aaaaaaaa$bbbbbbbbbbbbbbbbbbbbbb where the "aaaaaaaa" sequence is a random salt, and "bbbbbbbbbbbbbbbbbbbbbb" is the result of the mixing of the password and the salt up 1000 times in a particular way, and taking a modified base64-encoding of the md5 result.

The modified-base64 dictionary is:


The actual mixing algorithm can be redistributed under the terms of the GNU General Public License version 2 (or any later version), and you can get it from the GNU FTP site or any GNU mirror.


That password hash is salted. The salt is randomly generated and stored with the hash. The field delimiter between the salt and hash is the dollar sign ($).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.