Re: PEAR Auth, File_Passwd, and crypt() limitation?

Paul M Jones wrote:

Paul M Jones wrote:

Modern versions of htpasswd use by default SHA a much serious algo than DES or MD5. Well, it seems that a chineese team have found some collitions in the SHA hashing algo, what could compromise it too.

Hm. My Apache install is the OpenBSD 3.5 version, and it seems to be using the DES scheme. A little Googling ... aha:

    http://httpd.apache.org/docs/programs/htpasswd.html

DES is the default. The -m switch for MD5 is available, but is not supported on Windows. However, the docs state that "The MD5 algorithm used by htpasswd is specific to the Apache software; passwords encrypted using it will not be usable with other Web servers." I wonder if this applies to trying to use the PHP MD5 function as well. I guess I can see some experimentation in my future.

And the results are negative. The Apache-generated MD5 for a given string (which I will not give here ;-) is this ...

    $apr1$c6lOG...$wfdl2Kf13kRmfOfVQ.VPj1

... but the PHP MD5 function gives this:

    7cbb3252ba6b7e9c422fac5334d22054

Use the apr_md5 instead from File_Passwd (typing "foo" as pass): # htpasswd -n -m foo New password: Re-type new password: foo:$apr1$rVN3t/..$NcsDIKBg7bkMuPDtiCpcw1 # php5 -r 'include "File/Passwd.php"; echo File_Passwd::crypt_apr_md5("foo", "\$apr1\$rVN3t/..\$NcsDIKBg7bkMuPDtiCpcw1");' $apr1$rVN3t/..$NcsDIKBg7bkMuPDtiCpcw1 Interesting is that using PHP4, passwords does not match. A bug in File_Passwd::crypt_apr_md5()?

Maybe SHA will do it. Other ideas?

For SHA1 (typing "foo" as pass): # htpasswd -n -s foo New password: Re-type new password: foo:{SHA}C+7Hteo/D9vJXQ3UfzxbwnXaijM= # php -r 'echo "{SHA}" . base64_encode(pack("H40", sha1("foo")));' {SHA}C+7Hteo/D9vJXQ3UfzxbwnXaijM= Tomas V.V.Cox PS.- Yes I was wrong, by default is still DES, was my bash alias :-o