Timeline for Why does the CISCO's command 'enable secret <password>' produce different hash from MD5?
Current License: CC BY-SA 4.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 17, 2020 at 8:13 | comment | added | ilkkachu |
@JörgWMittag, yes, that's why the MD5-crypt hash (marked by $1$) is not a single run of the basic MD5 hash but an iterated construct, somewhat like PBKDF.
|
|
| Oct 16, 2020 at 21:27 | comment | added | Jörg W Mittag | … hash or password-based key-derivation function such as PBKDF2, BCrypt, Scrypt, Argon2. PBKDF2 is designed to be slow. BCrypt is designed to be slow and hard to speed up using memory. SCrypt is designed to be slow, hard to speed up using memory or parallelization, and hard to speed up using GPUs / FPGAs / ASICs. (But it is used in some cryptocurrencies, and thus dedicated hardware is starting to show up.) Argon2 is similar but newer, and there is a version that is hardened against side-channel attacks. | |
| Oct 16, 2020 at 21:25 | comment | added | Jörg W Mittag | "MD5 is mostly still safe to use but is known to have collisions […] if you want to use a stronger algorithm, such as SHA256" – Actually, both of these share the same flaw: they are fast. Being fast is a desirable property for almost every use case except password hashing. You are only authenticating once per session, so it doesn't matter whether the hash takes 1µs or 1s. For an attacker, however, it makes the difference between brute forcing a password in an hour or 100 years! A single Tesla V-100 GPU can compute about 2^57 MD5 hashes/month. For password hashing, you want a password … | |
| Oct 16, 2020 at 14:49 | comment | added | Zac67♦ |
In addition to Jesse's answer, e04efcfda166ec49ba7af5092877030e is a hexadecimal representation of the hash while A4DAiA6cbNxoV7Y2eEVOA0 is a base64 encoded binary. $1 should be the notation version and $mERr might be (part of) the salt.
|
|
| Oct 16, 2020 at 13:11 | history | edited | Jesse P. | CC BY-SA 4.0 |
added 5 characters in body
|
| Oct 16, 2020 at 11:09 | comment | added | HelloWorld | Ah, I thought about it but needed to verify. Thanks a lot | |
| Oct 16, 2020 at 11:09 | vote | accept | HelloWorld | ||
| Oct 16, 2020 at 11:05 | history | answered | Jesse P. | CC BY-SA 4.0 |