Gossamer Forum
Home : General : Perl Programming :

Please help

Quote Reply
Please help
How does the crypt function work EXACTLY - I'm trying to create a script and want to know about it. Any info is appeciated
Quote Reply
Re: Please help In reply to
From perldoc -f crypt we get:
Code:
crypt PLAINTEXT,SALT
Encrypts a string exactly like the crypt(3) function in
the C library (assuming that you actually have a version
there that has not been extirpated as a potential
munition). This can prove useful for checking the
password file for lousy passwords, amongst other things.
Only the guys wearing white hats should do this.

Note that `crypt()' is intended to be a one-way
function, much like breaking eggs to make an omelette.
There is no (known) corresponding decrypt function. As a
result, this function isn't all that useful for
cryptography. (For that, see your nearby CPAN mirror.)

When verifying an existing encrypted string you should
use the encrypted text as the salt (like `crypt($plain,
$crypted) eq $crypted'). This allows your code to work
with the standard `crypt()' and with more exotic
implementations. When choosing a new salt create a
random two character string whose characters come from
the set `[/0-9A-Za-z]' (like `join '', ('.', '/', 0..9,
'A'..'Z', 'a'..'z')[rand 64, rand 64]').

Here's an example that makes sure that whoever runs this
program knows their own password:

$pwd = (getpwuid($< ))[1];

system "stty -echo";
print "Password: ";
chomp($word = <STDIN> );
print "\n";
system "stty echo";

if (crypt($word, $pwd) ne $pwd) {
die "Sorry...\n";
} else {
print "ok\n";
}

Of course, typing in your own password to whoever asks
you for it is unwise.

Cheers,

Alex
Quote Reply
Re: Please help In reply to
Ok, I crypted a password - now it reads aay1vbtS6GWDc

- how would I uncrypt this and what would it read when you uncrypt it?
Quote Reply
Re: Please help In reply to
Did you fully read Alex's blurb? To quote:

"There is no (known) corresponding decrypt function."

So in other words, there is no way to return the original password from the encrypted password. Good thing too!

Dan Smile


Quote Reply
Re: Please help In reply to
Whats the point in cryping it then?

------------------
Quote Reply
Re: Please help In reply to
Keep reading the blurb.. =) To check the password, you take the guess, crypt it, and see if it matches the encrypted value. If it does, then the passwords match!

Cheers,

Alex
Quote Reply
Re: Please help In reply to
The point in encrypting passwords is for 'security' reasons. For example, if you use password (such as .htaccess) authentication and a hacker discovers your .htpasswd file (or other password file), since the passwords are encrypted, the hacker cannot use them.

As far as authentication I have no idea of the authentication algorithm. But basically, I imagine the server encrypts the password the user submits and then compares that with the logged encrypted password using some algorithm.

Dan Smile