Question

When creating a password with sha1pass, the first value from the token, is ‘4’.

For instance:

sha1pass test

gives us:

$4$GTdnmykS$25iwV+ruXRwor4pUmKF57uXHj70$

The token uses $ as separators: 25iwV+ruXRwor4pUmKF57uXHj70 is the computed hash, GTdnmykS is the generated salt, since I didn’t supply a second parameter, but what does that 4 mean?

The 4 is actually hardcoded, this is the last line of sha1pass, which is a Perl script:

print '$4$', $salt, '$', $pass, "\$\n";

Why is the first value of that token ‘4’, and what does it mean?

Answer 1

I’ve seen the convention used where $1$ denotes MD5 and $4$ denotes SHA1. It’s hardcoded because it’s simply encoding how the hash was generated for future comparison.