My questions about Crack are:

  1. Before we pass in salt do we have to define it ourselves? For example, since it's a 2 digit number do we create a method that produces random numbers for salt or does it do it on its own?

  2. The crypt() function encrypts a password, so is it my job to decrypt it? Just want to verify. So when someone passes in a hash I should decrypt that password to plaintext?

  3. Is salt used in the decryption of the password? In other words, if I have a hash and my salt begins with 52, do I need that value to decrypt the password?

  4. By brute force do they mean exhaust all possible values? Is this a case for permutations? So if I have an encrypted password, in order to decrypt it I should check for values like this:

    a aa aaa aaaa aaaaa b bb bbb bbbb bbbbb ab aab aaab aaaab abb etc...

  1. The salt must be saved together with the hash, so that we can reproduce the result. A password check function would hash a password using the same salt and compare the results. The salt here are the first two characters of the hash.
  2. Correct, though I would not say "encrypt" here. The password is not the thing that's encrypted, but the source of the key to encrypt a known message. A hash function is meant to be irreversible, though this property makes collisions (multiple passwords sharing a hash) possible.
  3. You will brute-force the password by generating candidates and hashing them with the given salt.
  4. Correct. Maybe test the shorter ones before the longer passwords, wasting less time on shorter passwords, but that's not a requirement.
  • So do I have to write a function to define the salt? Or is the salt just 50? – wolfbagel Apr 9 '19 at 17:14
  • Take the known hash for the salt, or maybe make a new string from its first two characters, but I guess most implementations should know they need to use exactly two characters. – Blauelf Apr 9 '19 at 17:27
  • Ok thank you! I was confused, didn't realize I have to extract the salt. Thought I had to generate it. – wolfbagel Apr 9 '19 at 17:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .