[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20060906140420.GA25603@openwall.com>
Date: Wed, 6 Sep 2006 18:04:20 +0400
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: hashing, not encryption; salts
On Thu, Aug 31, 2006 at 05:23:34PM -0400, John wrote:
> Now one more question: I understand the basic principle behind taking a
> dictionary work, or a string that JTR has created, encrypting that string,
> and then matching it against an encrypted hash. Using that same encryption
> algorithm, if the hashes match then that is your password.
This is about right, except that you're missing the distinction between
encryption and hashing. If you find yourself trying to write "encrypt",
"encryption", "encrypted", etc. in this context, you're most likely
using the wrong terms. "An encrypted hash" is the most confusing
because it is in fact reasonable to encrypt hashes in some special cases
(e.g., this is done on Windows systems with SYSKEY) - but you did not
mean that.
> But how does JTR do this with salted hashes? How does JTR figure out what
> salt was used ...
Salts are typically stored along with the hashes. For example, with
traditional Unix password hashes, the first two characters of the
13-character encodings are the salts.
P.S. I've changed the Subject now, but did not break the thread. You
should have done so before asking your "one more question" - to make
sure that the Subject reflects your new question. And you shouldn't
have quoted that much context (you've even quoted the unsubscription
notice)... Please note this for your future postings.
Thanks,
--
Alexander Peslyak <solar at openwall.com>
GPG key ID: 5B341F15 fp: B3FB 63F4 D7A3 BCCC 6F6E FC55 A2FC 027C 5B34 1F15
http://www.openwall.com - bringing security into open computing environments
Was I helpful? Please give your feedback here: http://rate.affero.net/solar
--
To unsubscribe, e-mail john-users-unsubscribe@...ts.openwall.com and reply
to the automated confirmation request that will be sent to you.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
