Eve and Alice have the same 8 character password of 'password' for their Linux accounts. A simplified entry from /etc/shadow is displayed below. Which of the following explains why their MD5 hashes…

The correct answer is A. Unique salts were used to create each MD5 hash. Salts are used in Linux password hashing. In this example, the IHLSRNty value is the salt for Eve's account and the ZxCnCjhq value is used to salt Alice's account. When unique, randomly generated salts are added to the password prior to hashing the MD5 sums will be different…

Vulnerability Exploitation & Privilege Escalation

Question

Eve and Alice have the same 8 character password of 'password' for their Linux accounts. A simplified entry from /etc/shadow is displayed below. Which of the following explains why their MD5 hashes are different? Alice $1$ZxCnCjhq$H1COX0aY6XZ4dVF.1Njux1 Eve $1$IHLSRNty$kwokpFBzomNYph.ZVnHMv.

Options

AUnique salts were used to create each MD5 hash.
BPasswords are encrypted using the user's name and PID prior to hashing.
CThe accounts were created at different times.
DThe algorithm inserts random characters into the passphrases after hashing.

How the community answered

(30 responses)

A
90% (27)
C
7% (2)
D
3% (1)

Explanation

Salts are used in Linux password hashing. In this example, the IHLSRNty value is the salt for Eve's account and the ZxCnCjhq value is used to salt Alice's account. When unique, randomly generated salts are added to the password prior to hashing the MD5 sums will be different. The time the accounts were created does not have modify the value of the hashes it only allows for a different random salt to be created. The MD5 generating algorithm also does not use the user name or PID during the hashing and thought the values of the salt are random, they are not inserted into the passphrase after it is hashed.

Topics

#password hashing#MD5 salt#Linux shadow file#cryptographic salting

Community Discussion

No community discussion yet for this question.

Full GCIH Practice