Re:encryption algs

miguel.dilaj_at_pharma.novartis.com
Date: 01/31/05

  • Next message: Philip Wagenaar: "Re: Betr.: Re: encryption" 
    To: security-basics@securityfocus.com
Date: Mon, 31 Jan 2005 11:50:32 +0000

    Hi all,

    That's correct, the "MD5" implementation on most modern *NIXes (including
    most Linux distros) is a salted hash, that incorporates the userID as part
    of the salt, and then encodes the result as Base64.
    A "pure" MD5 hash for a given plaintext is always the same, a salted hash
    isn't.

    I miss the point about "NT-MD5" someone mentioned. If you mean NTLM, it's
    not MD5. It's an MD4 hash from the unicode representation of the password.

    Feel free to experiment with Lepton's Crack (of which, incidentally, I'm
    one of the authors ;-) available at http://freshmeat.net/lcrack/

    I recommend also reading the 2 password sections of ISSAF
    (http://www.oissg.org/issaf/).

    Cheers,

    Miguel Dilaj (Nekromancer)
    Vice-President of IT Security Research, OISSG

    "Ghaith Nasrawi" <libero@aucegypt.edu>
    28/01/2005 09:42

     
            To: "postbase" <postbase@mail.ru>
            cc: "security-basics" <security-basics@securityfocus.com>, (bcc: Miguel
    Dilaj/PH/Novartis)
            Subject: Re:encryption algs

    UNIX-MD5? I "think" the MD5 algorithm used in most current *nix
    systems is a salted hash algorithm.
    {snip}

  • Next message: Philip Wagenaar: "Re: Betr.: Re: encryption"