RE: [PHP] crypt salt question

Hi!

How did you do the comparison with the PG_SQL database?? I believe there is
a UNIX function, able to retrieve the salt from a crypt string, or one that
can do the comparison, without a slat given. But I'm not quite sure. I'm
gonna investigate that. But how did you compare passwords before, when using
a time based "random" salt? I understand you use the CRYPT_STD_DES method
....

Greets,
Jan

-----Original Message-----
From: Andras Kende [mailto:andras@xxxxxxxxx]
Sent: Thursday, August 30, 2007 11:42 PM
To: php-general@xxxxxxxxxxxxx
Subject: [PHP] crypt salt question

Hello,



I'm trying to move some app from postgresql to mysql but unable to find out
how to authenticate

against the current crypted passwords with php..



insert to database:



$cset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789./";
$salt = substr($cset, time() & 63, 1) . substr($cset, time()/64 & 63, 1);
$password = crypt($password, $salt); //pass crypted version of password
for further processing



$result = pg_query ("INSERT INTO users (username, password) VALUES
('$username', '$password')");



I read the crypt is one way encryption but how to compare the password
entered with the encrypted

version if don't know the salt ??





Thanks,



Andras
.

Relevant Pages

  • Re: UsernameTokenManager and a hashed password database
    ... > (receiving hashed passwords) to work if the password database itself ... > My password database is hashed with SHA-1 and the passwords are ... > combined with a salt value before hashing. ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Hash MD5, Sha1 and Length
    ... For saving passwords on a database you need to use SHA-256, ... The salt prevents two people using the same password having the same ... hash and also stops an attacker pre-calculating hashes for commonly ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Password authentication using unix crypt
    ... We have a database that contains all of the user ids and passwords. ... encrypted using unix crypt function. ... only one-character salt key, instead of two. ...
    (comp.unix.aix)
  • Re: Newbie Salt and Pass Phrase Question.
    ... users tend to choose passwords that are ... Then the attacker somehow ... This is where the salt comes in. ... precompute his big database any more. ...
    (sci.crypt)
  • Re: Proposal for Lite Encryption for Login Form without SSL
    ... This way the password is not sent to the server ... simply copy the server-side salt used to hash the pw in the ... password in the database, it does make public the server-side salt ... This would be the equivalent to a public key in public key encryption ...
    (comp.lang.php)