NAME¶
Authen::Passphrase::SaltedDigest - passphrases using the generic salted digest
algorithm
SYNOPSIS¶
use Authen::Passphrase::SaltedDigest;
$ppr = Authen::Passphrase::SaltedDigest->new(
algorithm => "SHA-1",
salt_hex => "a9f524b1e819e96d8cc7".
"a04d5471e8b10c84e596",
hash_hex => "8270d9d1a345d3806ab2".
"3b0385702e10f1acc943");
$ppr = Authen::Passphrase::SaltedDigest->new(
algorithm => "SHA-1", salt_random => 20,
passphrase => "passphrase");
$ppr = Authen::Passphrase::SaltedDigest->from_rfc2307(
"{SSHA}gnDZ0aNF04BqsjsDhXAuEPGsy".
"UOp9SSx6BnpbYzHoE1UceixDITllg==");
$algorithm = $ppr->algorithm;
$salt = $ppr->salt;
$salt_hex = $ppr->salt_hex;
$hash = $ppr->hash;
$hash_hex = $ppr->hash_hex;
if($ppr->match($passphrase)) { ...
$userPassword = $ppr->as_rfc2307;
DESCRIPTION¶
An object of this class encapsulates a passphrase hashed using a generic
digest-algorithm-based scheme. This is a subclass of Authen::Passphrase, and
this document assumes that the reader is familiar with the documentation for
that class.
The salt is an arbitrary string of bytes. It is appended to passphrase, and the
combined string is passed through a specified message digest algorithm. The
output of the message digest algorithm is the passphrase hash.
The strength depends entirely on the choice of digest algorithm, so choose
according to the level of security required. SHA-1 is suitable for most
applications, but recent work has revealed weaknesses in the basic structure
of MD5, SHA-1, SHA-256, and all similar digest algorithms. A new generation of
digest algorithms emerged in 2008, centred around NIST's competition to design
SHA-3. Once these algorithms have been subjected to sufficient cryptanalysis,
the survivors will be preferred over SHA-1 and its generation.
Digest algorithms are generally designed to be as efficient to compute as
possible for their level of cryptographic strength. An unbroken digest
algorithm makes brute force the most efficient way to attack it, but makes no
effort to resist a brute force attack. This is a concern in some
passphrase-using applications.
The use of this kind of passphrase scheme is generally recommended for new
systems. Choice of digest algorithm is important: SHA-1 is suitable for most
applications. If efficiency of brute force attack is a concern, see
Authen::Passphrase::BlowfishCrypt for an algorithm designed to be expensive to
compute.
CONSTRUCTORS¶
- Authen::Passphrase::SaltedDigest->new(ATTR => VALUE, ...)
- Generates a new passphrase recogniser object using the generic salted
digest algorithm. The following attributes may be given:
- algorithm
- Specifies the algorithm to use. If it is a reference to a blessed object,
it must be possible to call the "new" method on that object to
generate a digest context object.
If it is a string containing the subsequence "::" then it
specifies a module to use. A plain package name in bareword syntax,
optionally preceded by "::" (so that top-level packages can be
recognised as such), is taken as a class name, on which the
"new" method will be called to generate a digest context object.
The package name may optionally be followed by "-" to cause
automatic loading of the module, and the "-" (if present) may
optionally be followed by a version number that will be checked against.
For example, "Digest::MD5-1.99_53" would load the Digest::MD5
module and check that it is at least version 1.99_53 (which is the first
version that can be used by this module).
A string not containing "::" and which is understood by
Digest->new will be passed to that function to generate a digest
context object.
Any other type of algorithm specifier has undefined behaviour.
The digest context objects must support at least the standard
"add" and "digest" methods.
- salt
- The salt, as a raw string of bytes. Defaults to the empty string, yielding
an unsalted scheme.
- salt_hex
- The salt, as a string of hexadecimal digits. Defaults to the empty string,
yielding an unsalted scheme.
- salt_random
- Causes salt to be generated randomly. The value given for this attribute
must be a non-negative integer, giving the number of bytes of salt to
generate. (The same length as the hash is recommended.) The source of
randomness may be controlled by the facility described in
Data::Entropy.
- hash
- The hash, as a string of bytes.
- hash_hex
- The hash, as a string of hexadecimal digits.
- passphrase
- A passphrase that will be accepted.
The digest algorithm must be given, and either the hash or the passphrase.
- Authen::Passphrase::SaltedDigest->from_rfc2307(USERPASSWORD)
- Generates a salted-digest passphrase recogniser from the supplied RFC2307
encoding. The scheme identifier gives the digest algorithm and controls
whether salt is permitted. It is followed by a base 64 string, using
standard MIME base 64, which encodes the concatenation of the hash and
salt.
The scheme identifiers accepted are " {MD4}" (unsalted
MD4), " {MD5}" (unsalted MD5), "
{RMD160}" (unsalted RIPEMD-160), " {SHA}"
(unsalted SHA-1), " {SMD5}" (salted MD5), and
"{SSHA}" (salted SHA-1). All scheme identifiers are
recognised case-insensitively.
METHODS¶
- $ppr->algorithm
- Returns the digest algorithm, in the same form as supplied to the
constructor.
- $ppr->salt
- Returns the salt, in raw form.
- $ppr->salt_hex
- Returns the salt, as a string of hexadecimal digits.
- $ppr->hash
- Returns the hash value, in raw form.
- $ppr->hash_hex
- Returns the hash value, as a string of hexadecimal digits.
- $ppr->match(PASSPHRASE)
- $ppr->as_rfc2307
- These methods are part of the standard Authen::Passphrase interface. Only
passphrase recognisers using certain well-known digest algorithms can be
represented in RFC 2307 form.
SEE ALSO¶
Authen::Passphrase, Crypt::SaltedHash
AUTHOR¶
Andrew Main (Zefram) <zefram@fysh.org>
COPYRIGHT¶
Copyright (C) 2006, 2007, 2009, 2010, 2012 Andrew Main (Zefram)
<zefram@fysh.org>
LICENSE¶
This module is free software; you can redistribute it and/or modify it under the
same terms as Perl itself.