3

i was trying to make grub password protected with grub2-mkpasswd-pbkdf2 and it works with centos 7 but i can't understand something about it.

every time i use this command it gives me different hash password for one unique string like 1234.

the results are like

grub.pbkdf2.sha512.10000.5A9xxx
grub.pbkdf2.sha512.10000.E18xxx

my question is:

how both of this hashed password work when copy them into 10_unix file and after update grub and how login process compare my plain password with hashed text in 10_unix file?

i mean it seems it's not something like md5() that result is same for one unique string every time we use it.

6

PBKDF2 is a salted password hash, meaning that in addition to the password, the hash function takes as input another string, the salt, which is generated randomly when the password is set or modified. The idea here is that an attacker cannot precompute the hashes corresponding to common passwords, since they also need the salt. Also, if multiple accounts happen to have the same password, this is not evident since the hashes are randomized. The salt is stored as part of the password hash, and to compare a plaintext password to the hashed one, the correct salt to use is read from the hash.

Compared to a plain cryptographic hash function (like MD5 or SHA-256), PBKDF2 is also iterated, meaning that it runs the underlying hash multiple times in a loop (thousands of times, at least). This is only to make the hash slower to compute, increasing the cost of guessing passwords matching the hashes by brute force.

In the case of grub, the format of the hash appears to be

grub.pbkdf2.sha512.[iterations].[salt].[hash]

The password hashes used by the system (/etc/shadow, see the crypt man page) are also iterated and salted, as any proper password hash should be.

For a whole lot of more on password hashes, see How to securely hash passwords? on security.SE

3
  • thanks @ilkkachu, your answer describe how pkkdf2 hash password, but i know how it compare plain password with hashed one? for example where this salt is stored? – user205726 Jun 22 '17 at 19:05
  • @user677900, the salt is stored as part of the password hash, in grub's case, it seems to be the second-to-last dot-separated field – ilkkachu Jun 22 '17 at 19:34
  • thanks @ilkkachu, now it makes sense how it accept different hash for unique password. salts are stored inside hash. – user205726 Jun 22 '17 at 19:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.