Re: never mind, Add new crypt methods to pwcmp?

I see the base routine uses the system crypt() function which on most 
systems handles the other hashes.  Works on FreeBSD and linux, not on 
MacOS which for some reason has an antique crypt().

On Sun, 15 May 2022, John R Levine wrote:

> I've been using pwcmp for a decade and it works fine.  It handles two kinds 
> of
> password hashes, the ancient Unix crypt and salted MD5, prefixed by '$1$'
>
> I use MySQL to store my login info and use its internal crypt() and md5()
> function to make the password hashes.  The current 5.7 has deprecated crypt
> and md5, and they'll be gone from MySQL 8.0.
>
> In principle I can use openssl-passwd to generate MD5 passwords, but its MD5
> passwords don't match what pwcmp does, and it would be nice if I could keep
> using mysql.  The defacto crypt standard says $5$ is SHA256 and $6$ is 
> SHA512.
> Before I write patches to pwcmp to add those, has anyone else already done 
> it?
>
> Bonus question: the MD5 code in pwcmp doesn't do what crypt does for a $1$ 
> password.  Was that deliberate?  Crypt does an overclever sequence of two 
> nested MD5 hashes and then 1000 more rounds of MD5 to make it slow.  It'd be 
> easy enough to borrow the code in glib, freebsd, or musl to make it match.
>
> R's,
> John
>

Regards,
John Levine, [email protected], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly