Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Where is the SALT attached to the password, AFTER or BEFORE the password?

When you are using GNU/Linux, the password are (mainly) encripted in MD5 and SHA
The operative system attaches a SALT to this password before encrypting it to avoid dictionary attacs.

My question is, where does the SO attaches the SALT, before, or after the password?

For example, is my password is: peter2011 before encripting it, it does:

saltpeter2011 or peter2011salt ?

Thanks in advance.


I dont know if you missunderstood my question, but I'm not asking how does Linux stores his passwords, I'm asking how does encripts it, i mean:

encrypt_in_md5(saltpeter2011) or encript_in_md5(peter2011salt)

I know that on the /etc/shadow file are stored as $salt&encripted_password

Thanks in advance!

like image 671
Peter Avatar asked May 22 '11 21:05

Peter


1 Answers

It's a little more complex than that, involving multiple rounds of appending and hashing. Best to just use crypt(3) and let the system handle it.

like image 59
Ignacio Vazquez-Abrams Avatar answered Sep 24 '22 18:09

Ignacio Vazquez-Abrams