.htaccess encryption

Do passwords encrypt differently each time?

[Jills2001]

Hi,

I am pretty new to htaccess, and have a quick question. In the .htpasswd file, do the encrypted passwords appear totally random? For example, my password file looks like this:

Jill1:45GOgE.e5n/AQ
Jill2:kFNaFtSX26m4Q

This is despite the fact that both passwords are actually the same word -- "test". Is it to be expected that the same string would appear different each time it is encrypted by the program?

Any help is appreciated!
Thanks in advance,
Jill

[dcrombie]

Most/all crypt routines use a 'salt' when encrypting. In this case, the 'salt' is the first two letters of the encrypted passwords. If you don't provide a salt then a random one will be used.

[sitz]

Or, put another way, a given password can have multiple crypted strings which map to it, but any crypted string will map to one (and only one) clear-text password.

[Jills2001]

Thanks a lot for the info!

Jill

[the_nerd]

Sorry if I hijack the thread ...

but I'm sure you know the answer to my apache-newbie question:

- How do I calculate a new password, using e.g. php
- How can I check if a password is correct (without using a browser, of course)

Thanks, nerd.

[MattyMoose]

- How do I calculate a new password, using e.g. php
- How can I check if a password is correct (without using a browser, of course)

There's no one way to create a password hash. The easiest way is using md5 [ca3.php.net]. Basically, you take what they enter in on the password form on account creation (or however your system is going to work), create an MD5 hash of that password, and store the hash.

So, say my password is "password". I run it through MD5, and I get "286755fad04869ca523320acce0dc6a4". I store that in my DB.

Then, to verify if someone entered the right password, I would do almost the same thing. I md5 what they entered, and compare the result to the stored md5 string.

You CANNOT derive the password from the hash. They are considered "one-way hashes". The way that the password is broken is by brute force, mostly. Suppose someone had read access to your DB, they would run through a dictionary, and word generator and encrypt each of those with MD5, and compare them (same as your legit function does).

For more info, look at [en.wikipedia.org ] and [en.wikipedia.org ].

If you want a specific PHP implementation, I'm sure there's tonnes around, and some examples in the PHP forum.

[sitz]

This is generally done with the crypt(3) function; PHP has an interface to this function, documented at [us4.php.net ]. Perl has an interface; the documentation for that can be seen by running

perldoc -f crypt

...on virtually any system with perl installed.