.\" Automatically generated by Pod::Man 4.14 (Pod::Simple 3.42)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" Set up some character translations and predefined strings.  \*(-- will
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
.\" double quote, and \*(R" will give a right double quote.  \*(C+ will
.\" give a nicer C++.  Capital omega is used to do unbreakable dashes and
.\" therefore won't be available.  \*(C` and \*(C' expand to `' in nroff,
.\" nothing in troff, for use with C<>.
.tr \(*W-
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
.ie n \{\
.    ds -- \(*W-
.    ds PI pi
.    if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
.    if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\"  diablo 12 pitch
.    ds L" ""
.    ds R" ""
.    ds C` ""
.    ds C' ""
'br\}
.el\{\
.    ds -- \|\(em\|
.    ds PI \(*p
.    ds L" ``
.    ds R" ''
.    ds C`
.    ds C'
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\"
.\" If the F register is >0, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD.  Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.\"
.\" Avoid warning from groff about undefined register 'F'.
.de IX
..
.nr rF 0
.if \n(.g .if rF .nr rF 1
.if (\n(rF:(\n(.g==0)) \{\
.    if \nF \{\
.        de IX
.        tm Index:\\$1\t\\n%\t"\\$2"
..
.        if !\nF==2 \{\
.            nr % 0
.            nr F 2
.        \}
.    \}
.\}
.rr rF
.\"
.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
.\" Fear.  Run.  Save yourself.  No user-serviceable parts.
.    \" fudge factors for nroff and troff
.if n \{\
.    ds #H 0
.    ds #V .8m
.    ds #F .3m
.    ds #[ \f1
.    ds #] \fP
.\}
.if t \{\
.    ds #H ((1u-(\\\\n(.fu%2u))*.13m)
.    ds #V .6m
.    ds #F 0
.    ds #[ \&
.    ds #] \&
.\}
.    \" simple accents for nroff and troff
.if n \{\
.    ds ' \&
.    ds ` \&
.    ds ^ \&
.    ds , \&
.    ds ~ ~
.    ds /
.\}
.if t \{\
.    ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
.    ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
.    ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
.    ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
.    ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
.    ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
.\}
.    \" troff and (daisy-wheel) nroff accents
.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
.ds ae a\h'-(\w'a'u*4/10)'e
.ds Ae A\h'-(\w'A'u*4/10)'E
.    \" corrections for vroff
.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
.    \" for low resolution devices (crt and lpr)
.if \n(.H>23 .if \n(.V>19 \
\{\
.    ds : e
.    ds 8 ss
.    ds o a
.    ds d- d\h'-1'\(ga
.    ds D- D\h'-1'\(hy
.    ds th \o'bp'
.    ds Th \o'LP'
.    ds ae ae
.    ds Ae AE
.\}
.rm #[ #] #H #V #F C
.\" ========================================================================
.\"
.IX Title "Authen::Passphrase::SaltedDigest 3pm"
.TH Authen::Passphrase::SaltedDigest 3pm "2022-06-08" "perl v5.34.0" "User Contributed Perl Documentation"
.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH "NAME"
Authen::Passphrase::SaltedDigest \- passphrases using the generic salted
digest algorithm
.SH "SYNOPSIS"
.IX Header "SYNOPSIS"
.Vb 1
\&        use Authen::Passphrase::SaltedDigest;
\&
\&        $ppr = Authen::Passphrase::SaltedDigest\->new(
\&                algorithm => "SHA\-1",
\&                salt_hex => "a9f524b1e819e96d8cc7".
\&                            "a04d5471e8b10c84e596",
\&                hash_hex => "8270d9d1a345d3806ab2".
\&                            "3b0385702e10f1acc943");
\&
\&        $ppr = Authen::Passphrase::SaltedDigest\->new(
\&                algorithm => "SHA\-1", salt_random => 20,
\&                passphrase => "passphrase");
\&
\&        $ppr = Authen::Passphrase::SaltedDigest\->from_rfc2307(
\&                "{SSHA}gnDZ0aNF04BqsjsDhXAuEPGsy".
\&                "UOp9SSx6BnpbYzHoE1UceixDITllg==");
\&
\&        $algorithm = $ppr\->algorithm;
\&        $salt = $ppr\->salt;
\&        $salt_hex = $ppr\->salt_hex;
\&        $hash = $ppr\->hash;
\&        $hash_hex = $ppr\->hash_hex;
\&
\&        if($ppr\->match($passphrase)) { ...
\&
\&        $userPassword = $ppr\->as_rfc2307;
.Ve
.SH "DESCRIPTION"
.IX Header "DESCRIPTION"
An object of this class encapsulates a passphrase hashed using
a generic digest-algorithm-based scheme.  This is a subclass of
Authen::Passphrase, and this document assumes that the reader is
familiar with the documentation for that class.
.PP
The salt is an arbitrary string of bytes.  It is appended to passphrase,
and the combined string is passed through a specified message digest
algorithm.  The output of the message digest algorithm is the passphrase
hash.
.PP
The strength depends entirely on the choice of digest algorithm, so
choose according to the level of security required.  \s-1SHA\-1\s0 is suitable for
most applications, but recent work has revealed weaknesses in the basic
structure of \s-1MD5, SHA\-1, SHA\-256,\s0 and all similar digest algorithms.
A new generation of digest algorithms emerged in 2008, centred around
\&\s-1NIST\s0's competition to design \s-1SHA\-3.\s0  Once these algorithms have been
subjected to sufficient cryptanalysis, the survivors will be preferred
over \s-1SHA\-1\s0 and its generation.
.PP
Digest algorithms are generally designed to be as efficient to compute
as possible for their level of cryptographic strength.  An unbroken
digest algorithm makes brute force the most efficient way to attack it,
but makes no effort to resist a brute force attack.  This is a concern
in some passphrase-using applications.
.PP
The use of this kind of passphrase scheme is generally recommended for
new systems.  Choice of digest algorithm is important: \s-1SHA\-1\s0 is suitable
for most applications.  If efficiency of brute force attack is a concern,
see Authen::Passphrase::BlowfishCrypt for an algorithm designed to
be expensive to compute.
.SH "CONSTRUCTORS"
.IX Header "CONSTRUCTORS"
.IP "Authen::Passphrase::SaltedDigest\->new(\s-1ATTR\s0 => \s-1VALUE, ...\s0)" 4
.IX Item "Authen::Passphrase::SaltedDigest->new(ATTR => VALUE, ...)"
Generates a new passphrase recogniser object using the generic salted
digest algorithm.  The following attributes may be given:
.RS 4
.IP "\fBalgorithm\fR" 4
.IX Item "algorithm"
Specifies the algorithm to use.  If it is a reference to a blessed object,
it must be possible to call the \*(L"new\*(R" method on that object to generate
a digest context object.
.Sp
If it is a string containing the subsequence \*(L"::\*(R" then it specifies
a module to use.  A plain package name in bareword syntax, optionally
preceded by \*(L"::\*(R" (so that top-level packages can be recognised as such),
is taken as a class name, on which the \*(L"new\*(R" method will be called to
generate a digest context object.  The package name may optionally be
followed by \*(L"\-\*(R" to cause automatic loading of the module, and the \*(L"\-\*(R"
(if present) may optionally be followed by a version number that will
be checked against.  For example, \*(L"Digest::MD5\-1.99_53\*(R" would load the
Digest::MD5 module and check that it is at least version 1.99_53
(which is the first version that can be used by this module).
.Sp
A string not containing \*(L"::\*(R" and which is understood by
Digest\->new will be passed to that function
to generate a digest context object.
.Sp
Any other type of algorithm specifier has undefined behaviour.
.Sp
The digest context objects must support at least the standard \f(CW\*(C`add\*(C'\fR
and \f(CW\*(C`digest\*(C'\fR methods.
.IP "\fBsalt\fR" 4
.IX Item "salt"
The salt, as a raw string of bytes.  Defaults to the empty string,
yielding an unsalted scheme.
.IP "\fBsalt_hex\fR" 4
.IX Item "salt_hex"
The salt, as a string of hexadecimal digits.  Defaults to the empty
string, yielding an unsalted scheme.
.IP "\fBsalt_random\fR" 4
.IX Item "salt_random"
Causes salt to be generated randomly.  The value given for this
attribute must be a non-negative integer, giving the number of bytes
of salt to generate.  (The same length as the hash is recommended.)
The source of randomness may be controlled by the facility described
in Data::Entropy.
.IP "\fBhash\fR" 4
.IX Item "hash"
The hash, as a string of bytes.
.IP "\fBhash_hex\fR" 4
.IX Item "hash_hex"
The hash, as a string of hexadecimal digits.
.IP "\fBpassphrase\fR" 4
.IX Item "passphrase"
A passphrase that will be accepted.
.RE
.RS 4
.Sp
The digest algorithm must be given, and either the hash or the passphrase.
.RE
.IP "Authen::Passphrase::SaltedDigest\->from_rfc2307(\s-1USERPASSWORD\s0)" 4
.IX Item "Authen::Passphrase::SaltedDigest->from_rfc2307(USERPASSWORD)"
Generates a salted-digest passphrase recogniser from the supplied
\&\s-1RFC2307\s0 encoding.  The scheme identifier gives the digest algorithm and
controls whether salt is permitted.  It is followed by a base 64 string,
using standard \s-1MIME\s0 base 64, which encodes the concatenation of the hash
and salt.
.Sp
The scheme identifiers accepted are "\fB{\s-1MD4\s0}\fR\*(L" (unsalted \s-1MD4\s0), \*(R"\fB{\s-1MD5\s0}\fR\*(L"
(unsalted \s-1MD5\s0), \*(R"\fB{\s-1RMD160\s0}\fR\*(L" (unsalted \s-1RIPEMD\-160\s0), \*(R"\fB{\s-1SHA\s0}\fR\*(L" (unsalted
\&\s-1SHA\-1\s0), \*(R"\fB{\s-1SMD5\s0}\fR\*(L" (salted \s-1MD5\s0), and \*(R"\fB{\s-1SSHA\s0}\fR" (salted \s-1SHA\-1\s0).
All scheme identifiers are recognised case-insensitively.
.SH "METHODS"
.IX Header "METHODS"
.ie n .IP "$ppr\->algorithm" 4
.el .IP "\f(CW$ppr\fR\->algorithm" 4
.IX Item "$ppr->algorithm"
Returns the digest algorithm, in the same form as supplied to the
constructor.
.ie n .IP "$ppr\->salt" 4
.el .IP "\f(CW$ppr\fR\->salt" 4
.IX Item "$ppr->salt"
Returns the salt, in raw form.
.ie n .IP "$ppr\->salt_hex" 4
.el .IP "\f(CW$ppr\fR\->salt_hex" 4
.IX Item "$ppr->salt_hex"
Returns the salt, as a string of hexadecimal digits.
.ie n .IP "$ppr\->hash" 4
.el .IP "\f(CW$ppr\fR\->hash" 4
.IX Item "$ppr->hash"
Returns the hash value, in raw form.
.ie n .IP "$ppr\->hash_hex" 4
.el .IP "\f(CW$ppr\fR\->hash_hex" 4
.IX Item "$ppr->hash_hex"
Returns the hash value, as a string of hexadecimal digits.
.ie n .IP "$ppr\->match(\s-1PASSPHRASE\s0)" 4
.el .IP "\f(CW$ppr\fR\->match(\s-1PASSPHRASE\s0)" 4
.IX Item "$ppr->match(PASSPHRASE)"
.PD 0
.ie n .IP "$ppr\->as_rfc2307" 4
.el .IP "\f(CW$ppr\fR\->as_rfc2307" 4
.IX Item "$ppr->as_rfc2307"
.PD
These methods are part of the standard Authen::Passphrase interface.
Only passphrase recognisers using certain well-known digest algorithms
can be represented in \s-1RFC 2307\s0 form.
.SH "SEE ALSO"
.IX Header "SEE ALSO"
Authen::Passphrase,
Crypt::SaltedHash
.SH "AUTHOR"
.IX Header "AUTHOR"
Andrew Main (Zefram) <zefram@fysh.org>
.SH "COPYRIGHT"
.IX Header "COPYRIGHT"
Copyright (C) 2006, 2007, 2009, 2010, 2012
Andrew Main (Zefram) <zefram@fysh.org>
.SH "LICENSE"
.IX Header "LICENSE"
This module is free software; you can redistribute it and/or modify it
under the same terms as Perl itself.