On Fri, 08 Jun 2012 12:05:56 +0300, Lars Noodén wrote:
On 6/8/12 12:02 PM, Alberto Fuentes wrote:On 06/08/2012 10:57 AM, Lars Noodén wrote:The hashed password + salt is stored in /etc/shadow. Where is the actual password salt for Debian stored?
Yes, I understand that the salt is different and random for each password, but how is it stored so that the hash can be used for authentication? Sorry for the dumb questions. Regards, /Lars
The salt is stored in the password entry in the shadow file along with the result of hash(salt+actualTextPassword).
The fact that the salt is "public" (quotes because /etc/shadow is readable only by root in most systems) does not detract from its usefulness. Its purpose is to multiply the necessary size of the reverse-look-up table needed in a time-vs-space tradeoff brute-force attack.
It's all explained in this wikipedia article. http://en.wikipedia.org/wiki/Salt_(cryptography) Rick