md5crypt question

[jgodfrey]

Hello,

I'm anything but a cryptographic expert, but I don't understand the
output of the tcllib [md5crypt::md5crypt] function.

For instance, if I use "admin" as the string to encrypt and "jeff" as
the salt, I get this:

(bin) 1 % md5crypt::md5crypt admin jeff
$1$jeff$Spjiqu9L743xC63Id5zFB0

Why is the "salt" value written to the result as clear text? I found
a "hash generator" page at...

http://www.insidepro.com/hashes.php

...that takes a string and a salt value and generates dozens of hashes
from the input. None of the many MD5-style hashes (in fact, none of
the hashes period) output the salt value as clear text. Doesn't that
defeat the purpose of the salt value? Am I somehow using it
incorrectly?

Thanks,

Jeff

[Helmut Giese]

On Tue, 4 Aug 2009 15:10:47 -0700 (PDT), jgodfrey
<jeff_g...@pobox.com> wrote:

>Hello,
>
>I'm anything but a cryptographic expert, but I don't understand the
>output of the tcllib [md5crypt::md5crypt] function.
>
>For instance, if I use "admin" as the string to encrypt and "jeff" as
>the salt, I get this:
>
>(bin) 1 % md5crypt::md5crypt admin jeff
>$1$jeff$Spjiqu9L743xC63Id5zFB0
>

Hi Jeff,
I don't know the md5crypt package but I have successfully used the md5
package included in tcllib.
Have a look at ::md5::hmac if you want to include a key/salt.
HTH
Helmut Giese

[Nick Hounsome]

This derives from the old unix /etc/passwd file which stores user
names and encrypted passwords.

The idea is that your plain text password "admin" is not stored
anywhere and so is not vulnerable.

Suppose that your username is "user1" and your password is "admin"
then you store
"user1" and $1$jeff$Spjiqu9L743xC63Id5zFB0 in your database/password
file.

When someone gives a password for "user1" you look up $1$jeff
$Spjiqu9L743xC63Id5zFB0, strip off the salt and use it to encrypt the
supplied password. If the result is $1$jeff$Spjiqu9L743xC63Id5zFB0
then the password was correct.
Better yet, if they are remote, you give them the salt and ask them to
give you the encrypted password - that way the plain text doesn't
appear on the wire.

The point of the salt is to ensure that two people using the same
password do not have the same hash so, in practice, the salt is
usually derived from the username or mad eunique in some other way.

The other hash functions that you have found are not for this
particular purpose and so do not add the salt but they could be used
in the same way. This is why it is called md5crypt rather than
something more general like md5hash.

In practice it doesn't really make things much safer because, if
someone can steal the password file they can just do a dictionary
attack on it but they do at least need to attack each password
separately because the disctionary needs to be encrypted using each
salt from the password file.

[Jeff Godfrey]

Nick Hounsome wrote:
> On 4 Aug, 23:10, jgodfrey <jeff_godf...@pobox.com> wrote:
>> Hello,
>>
>> I'm anything but a cryptographic expert, but I don't understand the
>> output of the tcllib [md5crypt::md5crypt] function.
>>
>> For instance, if I use "admin" as the string to encrypt and "jeff" as
>> the salt, I get this:
>>
>> (bin) 1 % md5crypt::md5crypt admin jeff
>> $1$jeff$Spjiqu9L743xC63Id5zFB0
>>
>> Why is the "salt" value written to the result as clear text? I found
>> a "hash generator" page at...
>>
>> http://www.insidepro.com/hashes.php
>>
>> ...that takes a string and a salt value and generates dozens of hashes
>> from the input. None of the many MD5-style hashes (in fact, none of
>> the hashes period) output the salt value as clear text. Doesn't that
>> defeat the purpose of the salt value? Am I somehow using it
>> incorrectly?
>>
>> Thanks,
>>
>> Jeff
>
> This derives from the old unix /etc/passwd file which stores user
> names and encrypted passwords.
>
> The idea is that your plain text password "admin" is not stored
> anywhere and so is not vulnerable.
>
> Suppose that your username is

[snip]

Nick,

Thanks for the in-depth explanation - that was helpful.

Jeff

[Jeff Godfrey]

Helmut,

Thanks, I'll check it out.

Jeff