Hi.

The salt is similar to an identifier. I've heard specific algorithms use specfic salts. I could be mistaken, but I believe perl uses either 3DES or DES. The first two characters comprise the salt used when the crypt function was called initially. When you perform some action that calls the crypt function ( such as login or su ), it extracts the first two characters ( the salt ), and attempts to 're-hash' your password with the following function:

if (crypt( $data, $hashed_text) eq $hashed_text )
// additional code here.

Since you are hopefully using the same password, and since the crypt() function is using the same salt, it should create the same hashed string again. If these two conditions are true, they will match and..success!

Sample run:

 

#!/usr/bin/perl -w
use strict;

my $data = "Perlmonks!";
$data = crypt( $data, "hj" );
print $data, "\n";

#Results in...

C:\perl>perl crypt_test.pl
hjCQi34Qt4uGE

C:\perl>
[download]

As you can see, the salt ( "hj" ) can be found at the beginning of the string.
If you wanted to incorporate this into an application, you could do something like this:

#!/usr/bin/perl -w
use strict;

my $password;
my $salt;

print "Please enter password: ";
chomp( $password = <STDIN> );
print "Enter two-char salt: ";
chomp( $salt = <STDIN> );

$password = crypt( $password, $salt );

# Then to 'verify' the authenticity, use 
# the value of $password you obtained earlier.

print "Please enter your password: ";
chomp( my $guess = <STDIN> );
print "Imposter!" if( crypt($guess, $password) ne $password);
[download]

I hope this helps,

-Katie a.k.a. DigitalKitty