password hashes

the structure of password hashes

A hash has three or four components delimited by special characters like $ :

• the hash algorithm.
• a cost/work factor – this is an integer that specifies the iteration count, making the hashing deliberately even more compute intensive in order to prevent brute force attacks.
• a salt value – this value is appended to the password and the resulting string is hashed. This ensures, that two passwords that are exactly the same result in different password hashes, thus preventing brute force attacks with pre-computed hash values (a.k.a. rainbow tables).
• the hash value of the password/salt combination.

Some password hashes, i.e., those stored in Linux’ /etc/shadow password file, do not contain a cost/work factor field.

The cool thing about hashes is that for a given hash algorithm, any arbitrary input of any arbitrary length results in a hash of the algorithm-specific hash length, i.e., 265 bit for SHA-512.

some hash algorithm identifiers