PHP and Perl's Crypt() function issues/incompatibilities

lack of encoding consistency between the two

[bwills]

I'm writing a batch script in php to move over my messageboard usernames and passwords to my new board. I have everything working except for the password encryption. From what I understand, PHP's crypt() is based on the same algorhythm(DES) as Perl's crypt() function. Initially, it seemed as though the salt(the first two chars of the username) should be lowercase(judging from other passwords and their encrypted passwords), after testing this, it did not prove to be the case.

The messageboard I am moving to uses Perl's crypt() function to encypher the user's passwords. I don't know Perl, but know PHP and am writing the converter in PHP using PHP's supposedly similar crypt() function, but it does not always encypher correctly (passwords that should work, don't - but there does not seem to be a pattern).

As of now, I have tested the following as salts:
- the username(unadulterated)
- the first two characters of the username, unadulterated as well
- the first two characters of the username converted to lowercase

I find it interesting that some of the passwords should work and others do not in each of the tested cases. Further, I still have not been able to find a pattern as far as which logins and passwords should work in any of the cases.

Has anyone else had similar issues? Any solutions?

[amoore]

It's not uncommon to use the first two characters of the encrypted password as the salt. It may be the case that the ones that work for you are the ones where the username and password are equal.
As an example, this comes from 'perldoc -f crypt' (modified a little for clarity):

if (crypt($guess, $cryptpw) ne $cryptpw) {
die "Sorry...\n";
} else {
print "ok\n";
}

[volatilegx]

I've read up a bit on the crypt function and I believe that there can be more than one permutation of an encrypted password, but I thought that the different permutations were still considered equal (at least by perl). Maybe this is not the case with PHP.