in reply to encryption confusion
when you add a variable salt to each users crypt then two users using the same password will get different hashes. (One problem with NTs passwords was related to using a fixed system wide salt allowing a passcraker to check a dictionary against all users on one machine with one pass through the crypt, see l0phtcrack).
The perl crypt function gives you back the salt as the first two bytes of the hash so you can test a password by passing the current hash as the salt. Here is a password checking example stolen from perldoc.
Cheers,if (crypt($password, $hash) ne $hash) { die "Sorry...\n"; } else { print "ok\n"; }
|
|---|