Problem - Kevin Tafuro

On systems that support MCF through crypt( ), * you can simply use crypt( ) as discussed
in Recipe 8.9 with some modification to the required salt. Otherwise, you can
use the implementation in this recipe.
Discussion
What we are doing here isn’t really encrypting a password. Actually,
we are creating a password validator. We use the term encryption
because it is in common use and is a more concise way to explain the
process.
MCF is a 7-bit encoding that allows for encoding multiple fields into a single string.
A dollar sign delimits each field, with the first field indicating the algorithm to use by
way of a predefined number. At present, only two well-known algorithms are
defined: 1 indicates MD5 and 2 indicates Blowfish. The contents of the first field also
dictate how many fields should follow and the type of data each one contains. The
first character in an MCF string is always a dollar sign, which technically leaves the
0th field empty.
For encoding MD5 in MCF, the first field must contain a 1, and two additional fields
must follow: the first is the salt, and the second is the MD5 checksum that is calculated
from a sequence of MD5 operations based on a nonintuitive process that
depends on the value of the salt and the password. The intent behind this process
was to slow down brute-force attacks; however, we feel that the algorithm is needlessly
complex, and there are other, better ways to achieve the same goals.
As with the traditional DES-based crypt( ), we do not recommend
that you use MD5-MCF in new authentication systems. You should
use it only when you must maintain compatibility with existing systems.
We recommend that you consider using something like PBKDF2
instead. (See Recipe 8.11.)
The function spc_md5_encrypt( ) implements a crypt( )-like function that uses the
MD5-MCF method that we’ve described. If it is successful (the only error that should
ever occur is an out-of-memory error), it will return a dynamically allocated buffer
that contains the encrypted password in MCF.
In this recipe, we present two versions of spc_md5_encrypt( ) in their entirety. The
first uses OpenSSLand standard C runtime functions; the second uses the native
Win32 API and CryptoAPI.
* FreeBSD, Linux, and OpenBSD support MCF via crypt( ). Darwin, NetBSD, and Solaris do not. Windows
also does not because it does not support crypt( ) at all.
Performing Password-Based Authentication with MD5-MCF | 403
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.