Question about Crack in PSET2

Question

My questions about Crack are:

1. Before we pass in salt do we have to define it ourselves? For example, since it's a 2 digit number do we create a method that produces random numbers for salt or does it do it on its own?

2. The crypt() function encrypts a password, so is it my job to decrypt it? Just want to verify. So when someone passes in a hash I should decrypt that password to plaintext?

3. Is salt used in the decryption of the password? In other words, if I have a hash and my salt begins with 52, do I need that value to decrypt the password?

4. By brute force do they mean exhaust all possible values? Is this a case for permutations? So if I have an encrypted password, in order to decrypt it I should check for values like this:

   a aa aaa aaaa aaaaa b bb bbb bbbb bbbbb ab aab aaab aaaab abb etc...

Answer 1

1. The salt must be saved together with the hash, so that we can reproduce the result. A password check function would hash a password using the same salt and compare the results. The salt here are the first two characters of the hash.
2. Correct, though I would not say "encrypt" here. The password is not the thing that's encrypted, but the source of the key to encrypt a known message. A hash function is meant to be irreversible, though this property makes collisions (multiple passwords sharing a hash) possible.
3. You will brute-force the password by generating candidates and hashing them with the given salt.
4. Correct. Maybe test the shorter ones before the longer passwords, wasting less time on shorter passwords, but that's not a requirement.