8:29 p.m.
I have slapd configured with password-hash {SSHA}. I'm uusing
slappasswd to generate passwords and notice that if I run it twice with
the same secret that I get different results. I guess I don't
understand this, but how does slapd verify a password if each time I
generate it I get something different?
Confused!
\\Greg
$OpenLDAP: slapd 2.3.27 (Oct 13 2006 09:16:43)
5:04 a.m.
Greg,
I imagine it uses a password salting technique (see
http://en.wikipedia.org/wiki/Password_salting) in order to better
protect the hashed password from a precompiled dictionary attack. If
password salting is used the salt is comonly stored as the prefix of
the value you see.
Andrew
9:32 a.m.
Interesting concept. So if I generate a SSHA hash and do not specify a
salt, does slappasswd pick one? Any idea how long it is?
Thanks,
\\Greg
Andrew Kay wrote:
Greg,
I imagine it uses a password salting technique (see
http://en.wikipedia.org/wiki/Password_salting) in order to better
protect the hashed password from a precompiled dictionary attack. If
password salting is used the salt is comonly stored as the prefix of
the value you see.
Andrew
4:40 a.m.
Greg,
According to
http://www.openldap.org/devel/cvsweb.cgi/~checkout~/libraries/liblutil/pa...
the salt is 4 bytes long. You don't specify a salt, a salt is
randomly generated when your password is hashed.
Andrew
8:17 a.m.
Andrew Kay wrote:
Greg,
According to
http://www.openldap.org/devel/cvsweb.cgi/~checkout~/libraries/liblutil/pa...
The actual definition of SSHA comes from Netscape. You can get some info in
the FAQ.
http://www.openldap.org/faq/index.cgi?file=347
the salt is 4 bytes long. You don't specify a salt, a salt is
randomly generated when your password is hashed.
Pretty standard practice for password hashing. (E.g., old Unix crypt uses a
two character salt.)
--
-- Howard Chu
Chief Architect, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc
OpenLDAP Core Team http://www.openldap.org/project/
5707
days inactive
5708
days old
openldap-software@openldap.org
4 comments
3 participants
participants (3)
-
Andrew Kay -
Greg Martin -
Howard Chu