[Date Prev][Date Next] [Chronological] [Thread] [Top]

RE: RFC2256: userPassword

At 02:07 PM 6/29/99 -0700, Howard Chu wrote:
>How do you store the key that's used to encrypt
>the userPassword?

When using one-way hash algorithms, you don't decrypt.
The server only needs to record the value of the hash and the salt
(if used).

	if Hash(password, Salt(userPassword)) equals userPassword
		approve
	else
		disapprove

where password is the password supplied with the bind operation,
userPassword is the recorded "encrypted" value, and Salt() extracts
the salt from the recorded value, and Hash generates an "encrypted"
value (with embedded salt).