Mailinglist Archive: opensuse-security (499 mails)

< Previous Next >
Fwd: Re: [suse-security] crypt
  • From: Carsten Meyer <Carsten.E.Meyer@xxxxxxxxxxxxx>
  • Date: Thu, 13 Jun 2002 01:03:56 +0200
  • Message-id: <E17IH8m-0007dj-00@xxxxxxxxxxxxxxxxxxxxxxxxx>

> Hello,
> I'm running Linux and discovered the following:
> perl -e "print crypt('thelonger', 'xy');"
> leads to output: xyCf30g5Eb0U.
> perl -e "print crypt('thelongerthebetter', 'xy');"
> leads to output: xyCf30g5Eb0U.
> actually
> perl -e "print crypt('thelonge', 'xy');"
> leads to output: xyCf30g5Eb0U.
> everything longer than 8 characters seems to be
> ignored. Or did I make any mistake???

lets have a look at crypt manpage: (man crypt)

crypt is the password encryption function. It is based on the
Data Encryption Standard algorithm with variations
intended (among other things) to discourage use of hardware
implementations of a key search.
key is a user's typed password.

salt is a two-character string chosen from the set [a-zA-Z0-9./].
This string is used to perturb the algorithm in one
of 4096 different ways.

By taking the lowest 7 bit of each character of the key, a 56-bit
key is obtained. This 56-bit key is used to encrypt
wich means 56-bit-key / 7bit per char => 8 characters are used (not more!)
repeatedly a constant string (usually a string consisting of all
zeros). The returned value points to the encrypted
password, a series of 13 printable ASCII characters (the first two
characters represent the salt itself). The return
value points to static data whose content is overwritten by each call.

Warning: The key space consists of 2**56 equal 7.2e16 possible values.
Exhaustive searches of this key space are possiĀ­
ble using massively parallel computers. Software, such as crack(1),
is available which will search the portion of this
key space that is generally used by humans for passwords. Hence,
password selection should, at minimum, avoid common
words and names. The use of a passwd(1) program that checks for
crackable passwords during the selection process is


Carsten Meyer

< Previous Next >
This Thread
  • No further messages