Problem - Kevin Tafuro

decrypt the encrypted data. To make the function one-way, crypt( ) encrypts the key
with itself. *
The DES algorithm requires a salt, which crypt( ) limits to 12 bits. It also prepends
the salt to the resulting ciphertext, which is base64-encoded. DES is a weak block
cipher to start, and the crypt( ) function traditionally limits passwords to a single
block, which serves to further weaken its capabilities because the block size is 64
bits, or 8 bytes.
Because DES is a weak cipher and crypt( ) limits the plaintext to a single DES block,
we strongly recommend against using crypt( ) in new authentication systems. You
should use it only if you have a need to maintain compatibility with an older system
that uses it.
Encrypting a password with crypt( ) is a simple operation, but programmers often
get it wrong. The most common mistake is to use the plaintext password as the salt,
but recall that crypt( ) stores the salt as the first two bytes of its result. Because passwords
are limited to eight bytes, using the plaintext password as the salt reveals at
least a quarter of the password and makes dictionary attacks easier.
The crypt( ) function has the following signature:
char *crypt(const char *key, const char *salt);
This function has the following arguments:
key
Password to encrypt.
salt
Buffer containing the salt to use. Remember that crypt( ) will use only 12 bits for
the salt, so it will use only the first two bytes of this buffer; passing in a larger
salt will have no effect. For maximum compatibility, the salt should contain only
alphanumeric characters, a period, or a forward slash.
The following function, spc_crypt_encrypt( ), will generate a suitable random salt
and return the result from calling crypt( ) with the password and generated salt. The
crypt( ) function returns a pointer to a statically allocated buffer, so you should not
call crypt( ) more than once without using the results from earlier calls because the
data returned from earlier calls will be overwritten.
#include
#include
char *spc_crypt_encrypt(const char *password) {
char salt[3];
static char *choices = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
"0123456789./";
* Some older versions encrypt a string of zeros instead.
Performing Password-Based Authentication with crypt( ) | 401
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.