A passphrase hash is a method of transforming a text string that can be remembered by a human user, into a result that can be used either:
The security properties required for these uses are effectively identical, which motivates considering passphrase hashes as a single algorithm category, rather than two different categories. However, particular algorithms may only be defined for one of these uses.
| ? BSD | PassphraseHash |
When a passphrase is verified, the first few characters of the authenticator determine which mechanism is used:
When an authenticator is generated, bcrypt is always used, because it is the most secure of the mechanisms.
| ? bcrypt | PassphraseHash |
| IteratedAndSalted(digest) | PassphraseHash |
String digest [creation/read, no default] - the name
of the message digest on which this Mac is to be based.
| ? MD5-crypt | PassphraseHash |
| Simple(digest) | PassphraseHash |
String digest [creation/read, no default] - the name
of the message digest on which this Mac is to be based.
| Salted(digest) | PassphraseHash |
String digest [creation/read, no default] - the name
of the message digest on which this Mac is to be based.
| ? Traditional-crypt3 | PassphraseHash |
A 12-bit salt is used, considered here as an integer between 0 and 4095. The password is represented as a US-ASCII string, and padded with zeroes up to 8 bytes. Passwords containing non-US-ASCII characters (with code points >= 128), or that are longer than 8 characters are invalid. (Note that many Unix implementations silently truncate passwords to 8 characters; to interoperate with an implementation that does this, the user of the "Traditional-crypt3" algorithm must do the truncation.)
Each byte of the US-ASCII-encoded, zero-padded password is then shifted left by one bit, and the result used as a key for a modified variant of DES. The key is used to encrypt a block of 8 zero bytes, 25 times. The parity of key bytes is ignored.
In standard DES, the output of each expansion permutation is a block of 48 bits, which are numbered as in FIPS PUB 46-2 (i.e. from 1 on the left to 48 on the right). Salt bits are numbered from 1 for the least significant bit, to 12 for the most significant bit. The modification of DES is that if salt bit i is set, then bits i and i + 24 are swapped in the DES expansion permutation (a.k.a. "E-box") output.
The salt and final modified-DES ciphertext are encoded in 13 bytes as follows:
encode(x) =When verifying an authenticator A, the salt is recovered from the first two characters of A (least significant 6 bits first):
("./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" ||
"abcdefghijklmnopqrstuvwxyz")[x]
Esalt(P) = encryption of the 8-byte block P, using DES modified
by the salt.
C = Esalt25(<0, 0, 0, 0, 0, 0, 0, 0>)
output =
encode(salt & 0x3F) ||
encode(salt >>> 6) ||
encode(C[0] >>> 2) ||
encode(((C[0] << 4) & 0x3F) | (C[1] >>> 2)) ||
encode(((C[1] << 2) & 0x3F) | (C[2] >>> 6)) ||
encode(C[2] & 0x3F) ||
encode(C[3] >>> 2) ||
encode(((C[3] << 4) & 0x3F) | (C[4] >>> 2)) ||
encode(((C[4] << 2) & 0x3F) | (C[5] >>> 6)) ||
encode((C[5] & 0x3F) ||
encode(C[6] >>> 2) ||
encode(((C[6] << 4) & 0x3F) | (C[7] >>> 2)) ||
encode((C[7] << 2) & 0x3F)
where
<< denotes shift left,
>>> denotes unsigned shift right,
|| denotes concatenation,
& denotes bitwise AND,
| denotes bitwise OR.
salt = encode-1(A[0]) | (encode-1(A[1]) << 6)and the authentication succeeds iff the correct output can be derived from the password and this salt.
It therefore SHOULD NOT be used for new applications.
| WindowsNT | PassphraseHash |
|
| Copyright and trademarks |