Free Republic
Browse · Search
General/Chat
Topics · Post Article

To: ShadowAce
Rainbow would just produce a password based on a 12 char policy and it wouldn't work.

Maybe Linux is doing a different type of salting then I'm familiar with. I thought salting was like this: SALT + Password = hash All you do is you put the salt unique id with the password (beginning, end, middle...wherevever). Then you make a hash out of it. You don't need to know the salt. as the entire salt+password is hashed. once you break the hash you now have the salt+password.

421 posted on 08/30/2005 8:08:21 AM PDT by for-q-clinton (If at first you don't succeed keep on sucking until you do succeed)
[ Post Reply | Private Reply | To 419 | View Replies ]


To: for-q-clinton
You don't need to know the salt. as the entire salt+password is hashed. once you break the hash you now have the salt+password.

My understanding of Rainbow is that it uses the entire string as the password. It assumes there is no salt. It will then find a string that hashes into the hash it is given. It will then return this as a password. The key to this is that it assumes no salt is given. Also, you, as a breaker, would not know how long the salt string is. Rainbow is producing a password based on a 12-char password, rather than a 4-cahr salt+8-char password. It doesn't know to look at only the portion of the given hash to produce a portion of a password.

424 posted on 08/30/2005 8:14:18 AM PDT by ShadowAce (Linux -- The Ultimate Windows Service Pack)
[ Post Reply | Private Reply | To 421 | View Replies ]

Free Republic
Browse · Search
General/Chat
Topics · Post Article


FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson