3 ms·

can you clarify what you mean by "plain md5"? if someone is using md5 with crypt(3) is that ok? i ask because of this - https://bugzilla.novell.com/show_bug.c

can you clarify what you mean by "plain md5"? if someone is using md5 with crypt(3) is that ok? i ask because of this - https://bugzilla.novell.com/show_bug.cgi?id=743715 https://bugzilla.novell.com/show_bug.cgi?id=743715

flixic 15y ago
I think teraflop had in mind salting.
- EGreg 15y ago
  I would recommend both salting and key strengthening.
- dodedo 15y ago
  A salt only protects against pre-computed dictionary attacks (rainbow tables). It does not offer any additional protection in this scenario.
michaelfairley 15y ago
http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/
riffraff 15y ago
AFAIK crypt(3) should not be using "plain" md5, it uses both a salt and variations of md5, plus the hash function is run many times so that bruteforce attacks are mitigated (it takes much more time to compute the hashes) googling..... http://en.wikipedia.org/wiki/Crypt_(Unix)#MD5-based_scheme http://en.wikipedia.org/wiki/Crypt_(Unix)#MD5-based_scheme
JoachimSchipper 15y ago
It's not best practice (use bcrypt/PBKDF2/scrypt), but there are no known or suspected attacks on that construction and the original article does not seem likely to help in finding one.