Verifying a User Password - calling crypt()


Hi,

I'm writing a function which is supposed to simply verify a username
and password against the /etc/passwd file. I'm sure I did this many
years ago by calling the encrypt() function on the the user's password
and comparing the result with the corresponding one read from
/etc/passwd. I recall that the encrypt function required a salt value
which was the password read from the /etc/passwd.

I'm calling encrypt() with the user's password as the salt and I'm
getting back a different password as the result. I've even tried using
the first two characters of the user's password as the salt but to no
avail.

I'm using AIX version 5.

Can anyone explain this or suggest some suitable code that will do the
job?

Thanks :)


--
phykell
------------------------------------------------------------------------
phykell's Profile: http://fantasticunix.com/forum/member.php?userid=69
View this thread: http://fantasticunix.com/forum/showthread.php?t=508894

.

Relevant Pages

  • Re: Custom UsernameTokenManager
    ... sender needs to know the salt. ... encrypt it first with server's public key. ... authentication anyway so you can encrypt and sign future messages. ... This salts the pw and username and encrypts/signs everything so no ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Why does SRP (Secure Remote Password) use the username to encrypt the password?
    ... SRP-6 passwords are generated as follows: ... Why is the username used to encrypt the password? ... hashing the plaintext password with a salt would be enough. ...
    (sci.crypt)
  • Re: Password storage facility exe - how safe is this idea?
    ... phrase of at least 15 characters and a passcode. ... A salt doesn't have to be secret, and should not be created by the user. ... Or, you could always call out to DPAPI, to encrypt the password data using ... they can't just change the pass-phrase in there and use the ...
    (microsoft.public.dotnet.security)
  • Re: my KDF vs dictionary attacks
    ... When the OP wrote, "the salt has 1 requirement, it must encrypt into a 32 character string, no more and no less, this means that the salt has a minimum of 5 digits and a maximum of 20 digits," did you understand what ... DES is a 64-bit block cipher - 8 bytes at a time. ...
    (sci.crypt)
  • Default AES Salt in ASPNET2 Site
    ... and uses custom AES and SHA1 keys ... in Web.config to encrypt or hash password information. ... The ManagedRinjdael approach uses both a key and a salt in its operation. ...
    (microsoft.public.dotnet.framework.aspnet)