4 ms·
A few people seem to be commenting that the salt used for all of the passwords is the same. This is not the case. These are crypt(3) strings and the $1$ at th
by mukyu 15y ago
A few people seem to be commenting that the salt used for all of the passwords is the same.
This is not the case.
These are crypt(3) strings and the $1$ at the beginning signifies the hash scheme used, not the salt--$scheme$salt$hash. The 1 means that FreeBSD-MD5 is the algorithm used, which is basically MD5 with the salt iterated 1000 times.
- snorkel 15y agoYour comment that this is MD5 x 1000 is very informative and got me searching for the FreeBSD MD5 crypt function, and I found this gem from /usr/src/lib/libcrypt/crypt-md5.c: /* * and now, just to make sure things don't run too fast * On a 60 Mhz Pentium this takes 34 msec, so you would * need 30 seconds to build a 1000 entry dictionary... */ for(i = 0; i < 1000; i++) { MD5Init(&ctx1); if(i & 1) MD5Update(&ctx1, (const u_char *)pw, strlen(pw)); ... ... which seems to still be the default implementation in FreeBSD. I'd guess it's time to increase the iterations to 200000.
- arundelo 15y agoEase of increasing how long it takes to compute the hash is the main idea behind bcrypt: http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/
- benatkin 15y agoYeah, it's pretty easy to change this in Devise, a popular auth library for rails that uses bcrypt by default, and to have a custom value to speed up unit tests: https://github.com/plataformatec/devise/wiki/Speed-up-your-unit-tests https://github.com/plataformatec/devise/wiki/Speed-up-your-u... config.stretches = Rails.env.test? ? 1 : 10