passwords

[Cole, Timothy D.]

> -----Original Message-----
> From:	William Deakin [SMTP:willd at pindar.com]
> Sent:	Thursday, March 23, 2000 5:54
> To:	Multiple recipients of list SAMBA-NTDOM
> Subject:	Re: passwords
> 
> As I remember, under AIX and Linux (the only two OS that I tried this on)
> the
> encryption key is (was?) stored in the shadow/passwd file, substantially
> reducing the amount of calculation required (IIRC the key was the last two
> bytes
> of the password string).
> 
	No.  This is a somewhat common misconception.

	The passwords are not encryped, but non-reversibly encoded.  The
password string in /etc/shadow (or /etc/passwd, for those who haven't
converted) is a non-reversible hash of the plaintext password.

	The first two characters are a 'salt' value which is randomly
generated and used to initialize the hash algorithm.

	When an input password is checked, the password the user entered is
hashed with the salt value, and the resulting hashes compared -- if they are
the same, there is an extremely high probability that the passwords matched.

	What the cracker you described did was to hash a large number of
possible plaintext passwords, and compare hashes, hoping to find a password
that hashed to the same value.  Not decrypt an "encrypted" password using
the "key".