使用盐的.htpasswd密码进行apache身份验证

Question

I am wondering how the Apache server authenticates me with .htpasswd

I have a .htpasswd file inside a folder. The .htpasswd content is generated with php and the password is encrypted with the crypt() function like this:

crypt($password,mb_substr($password,0,2));

The problem is that no matter which salt I use: mb_substr($password,0,2) or my_private_salt or 'whatever' the server will always authenticate me if I pass the correct username/password combination.

So, what's the point with that salt?

Thanks

Answer 1

I found the answer.

The php crypt() function generates a unique hash. If the salt is not specified then a random salt will be generated.

A BIG problem is that only the first 8 characters from the password will be used to generate the hash and only two characters from the salt.

The resulting hash will be composed of the salt + another 11 characters.

For example: if we do: crypt('1234567','12') the result will be "120QBxD1IX.Cw". Notice the first two characters from the hash (12)

This is how the Apache server will know how to encrypt the request and compare it with the saved hash in the .htpasswd file.

For a better explanation please see this link: http://blog.irreverence.co.uk/?p=858