-----BEGIN PGP SIGNED MESSAGE-----
On Wed, 19 Aug 1998, Joey Hess wrote:
> George Bonser wrote:
> > On Wed, 19 Aug 1998, Michael Beattie wrote:
> >
> > > Okay, true, but it was more of a feasability question, "if you can get the
> > > string, is it possible to use the following method to decrypt it??"
> >
> > Sure ... the login program has to decrypt it, doesn't it? You can
> > cut/paste passwd entries between linux systems ... the encrypted password
> > is not system-specific.
>
> No, it's not reversable. There is no way to get the original password from
> the data in the shadow password file.
>
> Login simply takes the password the user enters, encrypts it using crypt(),
> and compares it with that's in the password file. No decryption is done.
Actually a one way hash is used, not encryption. This is why it is not
possible to decrypt it -- it quite simply is not encrypted in the first
place.
- - Kyle
Kyle Amon email: [EMAIL PROTECTED]
Unix Systems Administrator phone: (203) 486-3290
Security Specialist pager: 1-800-759-8888 PIN 1616512
IBM Global Services or [EMAIL PROTECTED]
email: [EMAIL PROTECTED]
url: http://www.gnutec.com/kyle
KeyID 1024/26DD13D9
Fingerprint = 7D 86 D1 AE 4B E9 91 6A 4B BC B5 B4 12 F0 D3 1A
"GNU does not eliminate all the world's problems, only some of them."
- Richard Stallman
The GNU Manifesto, 1985
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv
iQCVAgUBNdrVzMTIuZsm3RPZAQE0agQAuAbthdwpDnUPMxrS1ioBWy1W78sXcaL0
Due3wZsa0Z6n/NuutSIf8QAFGxN2RLm1xhd1tLg0W4w/2XgTnkInyNB+eU4M7mGz
3czIfxjcSKm+YGBwzinOtlnm5vCWapqNKTfd4KM9tl3tSN85sPeKdGp0/ntMMrlu
Sq3wUr4hcU0=
=sa00
-----END PGP SIGNATURE-----
