Problem - Kevin Tafuro

salt[0] = choices[spc_rand_range(0, strlen(choices) - 1)];
salt[1] = choices[spc_rand_range(0, strlen(choices) - 1)];
salt[2] = 0;
return crypt(password, salt);
}
Verifying a password encrypted with crypt( ) involves encrypting the plaintext password
to be verified and comparing it with the already encrypted password, which
would normally be obtained from the passwd structure returned by getpwnam( ) or
getpwuid( ). (See Recipe 8.2.)
Recall that crypt( ) stores the salt as the first two bytes of its result. For purposes of
verification, you will not want to generate a random salt. Instead, you should use the
already encrypted password as the salt.
You can use the following function, spc_crypt_verify( ), to verify a password; however,
we’re really only providing an example of how crypt( ) should be called to verify
a password. It does little more than call crypt( ) and compare its result with the
encrypted password.
#include
#include
int spc_crypt_verify(const char *plain_password, const char *cipher_password) {
return !strcmp(cipher_password, crypt(plain_password, cipher_password));
}
See Also
Recipes 5.2, 8.2, 8.13
8.10 Performing Password-Based
Authentication with MD5-MCF
Problem
You want to use MD5 as a method for encrypting passwords.
Solution
Many modern systems support the use of MD5 for encrypting passwords. An encoding
known as Modular Crypt Format (MCF) is used to allow the use of the traditional
crypt( ) function to handle the old DES encryption as well as MD5 and any
number of other possible algorithms.
402 | Chapter 8: Authentication and Key Exchange
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.