1

As the title is saying I want to implement a simple Sha512 encryption with the C function crypt(3).

I have pretty much copied the examplecode from the GNU, even though I know the salt calculation isn`t very good. Also I changed the $1$ to the $6$, since the manpage of crypt says that this would create an SHA512 hash.

Anyway the output seems very strange to me, so I am asking if there is anything wrong with my code:

This is pretty much the function:

static char* hashStr(char *str) {
    unsigned long seed[2];
    char salt[] = "$6$........";
    const char *const seedchars =
    "./0123456789ABCDEFGHIJKLMNOPQRST"
    "UVWXYZabcdefghijklmnopqrstuvwxyz";

    seed[0] = time(NULL);
    seed[1] = getpid() ^ (seed[0] >> 14 & 0x30000);

    // Turn it into printable characters from `seedchars'.
    for (int i = 0; i < 8; i++) {
        salt[3+i] = seedchars[(seed[i/5] >> (i%5)*6) & 0x3f];
    }
    return crypt(str, salt);
}

Heres some output:

Bro  -> $6$9AcWGmwG$5faOmA7QpXQ/MMmbFAT085HraONeaMYlTcBg09WmQUpSI.PkcrcDQiXCetyjuIK3sr3H5cIFyxHD.fywr9UfY/

Homie -> $6$BAcWGnwG$KUPLOdpa8QgF.cVljBXYl62lL9zejDW/ZWENUoC90jO4NinNc1Itk7Z1Zo3myogmHR/YPwoc2cqfjBL0cf.Ht0

hey -> $6$IAcWGowG$47WGhO6Hco9DOc0rnxu/KEttLvjv4wH6vJX8qj6hALr0Wa1/YQb0JETEcRgpe9.cPvwOBjQduLZn17gwSXM86.  

What makes me wonder if the output is legit is especially that theres this &6& at the beginning every time.

3
  • 2
    salt[3+i]that's why you keep the &6& at the beginning. Nov 18, 2013 at 22:13
  • yeah the &6& at the beginning is needed for crypt(3) to determine which kind of hash algorithm should be used, but I find it a bit strange that it is also in the output. Nov 18, 2013 at 22:21
  • Where did you get the code? Nov 18, 2013 at 22:39

1 Answer 1

3

As you can see here crypt(3) return:

$id$salt$encrypted

That's why you get $6$8chars$...

1
  • I see, thank you for your answer. So basically that means my code is alright. Nov 18, 2013 at 23:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.