Problem - Kevin Tafuro

Solution
Use the PBKDF2 method of converting passwords to symmetric keys. See Recipe 4.10
for a more detailed discussion of PBKDF2.
Discussion
What we are doing here isn’t really encrypting a password. Actually,
we are creating a password validator. We use the term encryption
because it is in common use and is a more concise way to explain the
process.
The PBKDF2 algorithm provides a way to convert an arbitrary-sized password or
passphrase into an arbitrary-sized key. This method fits perfectly with the need to
store passwords in a way that does not allow recovery of the actual password. The
PBKDF2 algorithm requires two extra pieces of information besides the password: an
iteration count and a salt. The iteration count specifies how many times to run the
underlying operation; this is a way to slow down the algorithm to thwart brute-force
attacks. The salt provides the same function as the salt in MD5 or DES-based crypt( )
implementations.
Storing a password using this method is simple; store the result of the PBKDF2 operation,
along with the iteration count and the salt. When verification of a password is
required, retrieve the stored values and run the PBKDF2 using the supplied password,
saved iteration count, and salt. Compare the output of this operation with the
stored result, and if the two are equal, the password is correct; otherwise, the passwords
do not match.
The function spc_pbkdf2_encrypt( ) implements a crypt( )-like function that uses the
PBKDF2 method that we’ve described, and it assumes the implementation found in
Recipe 4.10. If it is successful (the only error that should ever occur is an out-ofmemory
error), it will return a dynamically allocated buffer that contains the
encrypted password in MCF, which encodes the salt and encrypted password in
base64 as well as includes the iteration count.
MCF delimits the information it encodes with dollar signs. The first field is a digit
that identifies the algorithm represented, which also dictates what the other fields
contain. As of this writing, only two algorithms are defined for MCF: 1 indicates
MD5 (see Recipe 8.9), and 2 indicates Blowfish. We have chosen to use 10 for
PBKDF2 so that it is unlikely that it will conflict with anything else.
#include
#include
#include
#include
#include
Performing Password-Based Authentication with PBKDF2 | 409
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.