crypted password digests have the salt tacked onto the front in plain text, like this:

$ perl -e'print crypt("glaummer", "es"), $/'
esWBuiGT4AQcA
$
[download]

Update: Fixed typo in code (s/crupt/crypt/) ++rob_au for the spot.

After Compline,
Zaxo

 

#!/usr/bin/perl -w
use strict;

my $data = "Perlmonks!";
$data = crypt( $data, "hj" );
print $data, "\n";

#Results in...

C:\perl>perl crypt_test.pl
hjCQi34Qt4uGE

C:\perl>
[download]

#!/usr/bin/perl -w
use strict;

my $password;
my $salt;

print "Please enter password: ";
chomp( $password = <STDIN> );
print "Enter two-char salt: ";
chomp( $salt = <STDIN> );

$password = crypt( $password, $salt );

# Then to 'verify' the authenticity, use 
# the value of $password you obtained earlier.

print "Please enter your password: ";
chomp( my $guess = <STDIN> );
print "Imposter!" if( crypt($guess, $password) ne $password);
[download]

The salt is similar to an identifier.

kinda. The salt is more like a pointer into a set of "hashed" values (not hash as in perl hash but hash as in hash function). The whole purpose of salt is to prevent dictionary attacks by creating a much larger pool of hashed passwords from the same plaintext.

I've heard specific algorithms use specfic salts

Somewhat true. For some versions of the crypt function, the format of the hashed value is different based on the algorithm (YMMV):

Standard DES-based encryption has a two character salt
Extended DES-based encryption has a nine character salt
MD5 encryption has a twelve character salt starting with $1$
Blowfish encryption has a sixteen character salt starting with $2$

I believe perl uses either 3DES or DES.

Possibly. It may be DES, Extended DES, MD5, Blowfish or whatever else your c library crypt provides.

For great reading about the crypt function and salt, check out Robert Morris and Ken Thompson's seminal work - Password Security: A Case History ( Communications of the ACM, 22(11):594-597, November 1979). Here's a google cache link

-derby

I could be mistaken, but I believe perl uses either 3DES or DES.

From 'perldoc -f crypt': Encrypts a string exactly like the crypt(3) function in the C library. So actually Perl depends on system library (aka libc on Unix systems) here. I've seen crypt to return MD5 hashes on some systems.

--
Ilya Martynov (http://martynov.org/)

-derby

But if you're checking that crypt($password) matches the crypt($password) you've saved previously, and you use a different salt, it won't match, surely?

I don't know a lot about it either, but this seems to be correct.

use strict ;

my @n = qw( xx xy yx yy ) ;
my @m = @n ;

foreach my $outer ( @n )
{
    foreach my $inner ( @m )
    {
        print crypt( 'perlmonk', $inner ) eq crypt( 'perlmonk', $outer
+ ) ?
          '1' : '0' ;
    }
    print "\n" ;
}
[download]

1000
0100
0010
0001
[download]