On Wed, 7 Jul 1999, Peter Wemm wrote:
> Say... you wouldn't like to impliment an NT-style password hash, would you?
This is actually very easy, it turns out - the NT hash is just an MD4 over the
unicode version of the password, which is (for the default english locale or
whatever you call it), just the ascii character string padded out to be 16-bit
little-endian (i.e. alternating the 8bit characters with zero bytes).
MS-CHAP then takes this password hash and encrypts it with the challenge which
is communicated to the peer, so the password hash is effectively plaintext
equivalent for the purpose of the handshake. I'm not sure whether this would
help out ppp at all except by breaking out the code into libcrypt(), since
you're not authenticating with your local account password, and since
PPPD is maintained externally the code would stay there for the general
(non-FreeBSD) case.
This would make samba account management easier as there's only one password
file to keep in sync. Even though MD4 is insecure and therefore makes a bad
password hashing algorithm, if you're running samba for the purposes of
authenticating a user against an NT domain then you already have a copy of the
(samba) password file on-hand so you can just break that one if you're evil.
I should have the code ready by tomorrow night.
Kris
-----
"Never criticize anybody until you have walked a mile in their shoes,
because by that time you will be a mile away and have their shoes."
-- Unknown
To Unsubscribe: send mail to majord...@freebsd.org
with "unsubscribe freebsd-hackers" in the body of the message
