Re: Hash salt (was Re: BCRYPT - Why not using it?)

[Ron Johnson <ron.l.johnson@cox.net>]

On 04/07/2011 01:20 AM, Aaron Toponce wrote:
> On Wed, Apr 06, 2011 at 11:52:04PM -0500, Ron Johnson wrote:
> > Is the salt just bits that are either pre- or suffixed to your
> > password before being run through the hashing function?
>
> The salt is generally appended to the password. For the specific case of
> passwd(1), I'm not entirely sure, without looking at the source.
>
> > The first 3 characters of every hash in my /etc/shadow are the same.
> > That's what, 24 bits?
>
> Thats.... interesting. Each salt is created at random. Combined with the
> password string, it shuold produce a very unique hash. Because your hashes
> all start with the same 3 characters, then you've been very lucky in the
> output, due to the immense size of the keyspace.

Having the first 3 characters all be "$6$" makes sense based upon the 
explanation in your other email.  I thought that was the salt.  Each 
user's salt is definitely different.

--
"Neither the wisest constitution nor the wisest laws will secure
the liberty and happiness of a people whose manners are universally
corrupt."
Samuel Adams, essay in The Public Advertiser, 1749