From: Vincent Bray Date: Sat, 8 Sep 2007 14:25:32 +0000 (+0000) Subject: Sync with changes to wiki version of password formats document. Add to /misc/ index. X-Git-Tag: 2.3.0~1447 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=1ecea166783ea1f560157f32cadc97411da600a0;p=apache Sync with changes to wiki version of password formats document. Add to /misc/ index. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@573845 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/docs/manual/misc/index.html.en b/docs/manual/misc/index.html.en index 91eb22a932..ac4626f244 100644 --- a/docs/manual/misc/index.html.en +++ b/docs/manual/misc/index.html.en @@ -67,6 +67,13 @@

This document acts as a reference page for most of the relevant standards that Apache follows.

+ +
Password Encryption Formats
+ +
+

Discussion of the various ciphers supported by Apache for + authentication purposes.

+
diff --git a/docs/manual/misc/index.xml b/docs/manual/misc/index.xml index 9f0c8c446c..e59da6fdf6 100644 --- a/docs/manual/misc/index.xml +++ b/docs/manual/misc/index.xml @@ -71,6 +71,13 @@

This document acts as a reference page for most of the relevant standards that Apache follows.

+ +
Password Encryption Formats
+ +
+

Discussion of the various ciphers supported by Apache for + authentication purposes.

+
diff --git a/docs/manual/misc/password_encryptions.html.en b/docs/manual/misc/password_encryptions.html.en index 3c4fb09ec9..43ea32f33f 100644 --- a/docs/manual/misc/password_encryptions.html.en +++ b/docs/manual/misc/password_encryptions.html.en @@ -39,8 +39,9 @@
Windows, BEOS, & Netware only.
CRYPT
-
Unix only. Calls the Unix crypt(3) function with a randomly-generated - 32-bit salt and the password.
+
Unix only. Uses the traditional Unix crypt(3) function + with a randomly-generated 32-bit salt (only 12 bits used) and the first 8 + characters of the password.
SHA1
"{SHA}" + Base64-encoded SHA-1 digest of the password.
@@ -48,7 +49,7 @@
MD5
"$apr1$" + the result of an Apache-specific algorithm using an iterated (1,000 times) MD5 digest of various combinations of a - randomly-generated 32-bit salt and the password. See the APR source file + randoml 32-bit salt and the password. See the APR source file apr_md5.c for the details of the algorithm.
@@ -92,8 +93,8 @@

Validating CRYPT or MD5 passwords with the OpenSSL command line program

-

The salt for a CRYPT password is the first two characters (as a - Base64-encoded binary value). To validate myPassword against +

The salt for a CRYPT password is the first two characters (converted to + a binary value). To validate myPassword against rqXexS6ZhobKA

CRYPT

@@ -119,9 +120,9 @@

Database password fields for mod_dbd

The SHA1 variant is probably the most useful format for DBD - authentication. Since the SHA1-hash and Base64-encoding functions are - commonly available, other software can populate a database with encrypted - passwords that are usable by Apache basic authentication.

+ authentication. Since the SHA1 and Base64 functions are commonly + available, other software can populate a database with encrypted passwords + that are usable by Apache basic authentication.

To create Apache SHA1-variant basic-authentication passwords in various languages:

@@ -158,8 +159,8 @@
top

Digest Authentication

-

There is only one format that Apache recognizes for - digest-authentication passwords. This format is the MD5 hash of the string +

Apache recognizes one format for + digest-authentication passwords - the MD5 hash of the string user:realm:password as a 32-character string of hexadecimal digits. realm is the Authorization Realm argument to the AuthName directive in @@ -167,7 +168,7 @@

Database password fields for mod_dbd

-

Since the MD5-hash function is commonly available, other software can +

Since the MD5 function is commonly available, other software can populate a database with encrypted passwords that are usable by Apache digest authentication.

@@ -186,7 +187,7 @@ s = "0" + s; - // String s is the digest hash + // String s is the encrypted password

ColdFusion

@@ -198,6 +199,11 @@ Digest::MD5.hexdigest(user + ':' + realm + ':' + password)

+

PostgreSQL (with the contrib/pgcrypto functions installed)

+ + encode(digest( user || ':' || realm || ':' || password , 'md5'), 'hex') +

+
diff --git a/docs/manual/misc/password_encryptions.xml b/docs/manual/misc/password_encryptions.xml index 188cb6463e..d5067bc6aa 100644 --- a/docs/manual/misc/password_encryptions.xml +++ b/docs/manual/misc/password_encryptions.xml @@ -40,8 +40,9 @@
Windows, BEOS, & Netware only.
CRYPT
-
Unix only. Calls the Unix crypt(3) function with a randomly-generated - 32-bit salt and the password.
+
Unix only. Uses the traditional Unix crypt(3) function + with a randomly-generated 32-bit salt (only 12 bits used) and the first 8 + characters of the password.
SHA1
"{SHA}" + Base64-encoded SHA-1 digest of the password.
@@ -49,7 +50,7 @@
MD5
"$apr1$" + the result of an Apache-specific algorithm using an iterated (1,000 times) MD5 digest of various combinations of a - randomly-generated 32-bit salt and the password. See the APR source file + randoml 32-bit salt and the password. See the APR source file apr_md5.c for the details of the algorithm.
@@ -93,8 +94,8 @@
Validating CRYPT or MD5 passwords with the OpenSSL command line program -

The salt for a CRYPT password is the first two characters (as a - Base64-encoded binary value). To validate myPassword against +

The salt for a CRYPT password is the first two characters (converted to + a binary value). To validate myPassword against rqXexS6ZhobKA

CRYPT @@ -120,9 +121,9 @@
Database password fields for mod_dbd

The SHA1 variant is probably the most useful format for DBD - authentication. Since the SHA1-hash and Base64-encoding functions are - commonly available, other software can populate a database with encrypted - passwords that are usable by Apache basic authentication.

+ authentication. Since the SHA1 and Base64 functions are commonly + available, other software can populate a database with encrypted passwords + that are usable by Apache basic authentication.

To create Apache SHA1-variant basic-authentication passwords in various languages:

@@ -159,8 +160,8 @@
Digest Authentication -

There is only one format that Apache recognizes for - digest-authentication passwords. This format is the MD5 hash of the string +

Apache recognizes one format for + digest-authentication passwords - the MD5 hash of the string user:realm:password as a 32-character string of hexadecimal digits. realm is the Authorization Realm argument to the AuthName directive in @@ -168,7 +169,7 @@

Database password fields for mod_dbd -

Since the MD5-hash function is commonly available, other software can +

Since the MD5 function is commonly available, other software can populate a database with encrypted passwords that are usable by Apache digest authentication.

@@ -187,7 +188,7 @@ s = "0" + s; - // String s is the digest hash + // String s is the encrypted password ColdFusion @@ -199,6 +200,11 @@ Digest::MD5.hexdigest(user + ':' + realm + ':' + password) + + PostgreSQL (with the contrib/pgcrypto functions installed) + encode(digest( user || ':' || realm || ':' || password , 'md5'), 'hex') + +