The following issue has been RESOLVED. ====================================================================== http://www.dbmail.org/mantis/view.php?id=340 ====================================================================== Reported By: aaron Assigned To: aaron ====================================================================== Project: DBMail Issue ID: 340 Category: Authentication layer Reproducibility: always Severity: minor Priority: normal Status: resolved Resolution: fixed Fixed in Version: SVN Trunk ====================================================================== Date Submitted: 05-May-06 22:51 CEST Last Modified: 07-May-06 09:14 CEST ====================================================================== Summary: MD5-HASH encryption type may be broken Description: On Thu, May 4, 2006, Aaron Stone <[EMAIL PROTECTED]> said:
> On Thu, 2006-05-04 at 00:18 -0700, kbaker wrote: > >> Java md5-digest result: >> X03MO1qnZdYdgyfeuILPmQ== >> >> dbmail-util -p md5-hash-raw result: >> X03MO1qnZdYdgyfeuILPmQ== >> >> So I would like to use the md5-hash-raw encoding.... problem is that >> when I do I can not log into the IMAP account. The database shows teh >> md5-hash-raw encoding as MD5 > > Ok, yeah, I do see that something isn't working right. I'll have some > time this weekend to soak my head in the MD5 stuff again. Just an FYI -- this isn't fixed in 2.1.6 because the code looks almost the same as code going back to 2.0, which means its possible that this MD5 mode never worked right. I'm going to write a test suite module before making any changes so that we don't get any regressions in the other password encryption types. Aaron ====================================================================== ---------------------------------------------------------------------- aaron - 07-May-06 03:19 ---------------------------------------------------------------------- Ok, so I knew that the == off the end of those was familiar! It's the MD5 encoded in base64. Incidentally, the the -raw variants mean that you're supplying the password in pre-encoded in the format that DBMail is expecting. The is useful for grabbing passwords from other sources (as you're doing). As for md5-hash / md5-hash-raw showing only "md5" in the database, its because md5 and md5-hash are aliases. I'm working on a patch to add md5base64 support. ---------------------------------------------------------------------- aaron - 07-May-06 09:14 ---------------------------------------------------------------------- Took the opportunity to write a password encryption type test suite and to really clean up the md5 and base64 code that was littered about and even duplicated using different algorithms in different places. Issue History Date Modified Username Field Change ====================================================================== 05-May-06 22:51 aaron New Issue 05-May-06 22:51 aaron Status new => assigned 05-May-06 22:51 aaron Assigned To => aaron 07-May-06 03:19 aaron Note Added: 0001156 07-May-06 09:14 aaron Status assigned => resolved 07-May-06 09:14 aaron Fixed in Version => SVN Trunk 07-May-06 09:14 aaron Resolution open => fixed 07-May-06 09:14 aaron Note Added: 0001157 ======================================================================
