| [9] | 1 | .TH CRYPT 3
|
|---|
| 2 | .SH NAME
|
|---|
| 3 | crypt \- one-way password encryption function
|
|---|
| 4 | .SH SYNOPSIS
|
|---|
| 5 | .ft B
|
|---|
| 6 | .nf
|
|---|
| 7 | #define _MINIX_SOURCE 1
|
|---|
| 8 | #include <unistd.h>
|
|---|
| 9 |
|
|---|
| 10 | char *crypt(const char *\fIkey\fP, const char *\fIsalt\fP)
|
|---|
| 11 | .fi
|
|---|
| 12 | .ft P
|
|---|
| 13 | .SH DESCRIPTION
|
|---|
| 14 | The first use of
|
|---|
| 15 | .B crypt()
|
|---|
| 16 | is to encrypt a password. Its second use is to authenticate a shadow
|
|---|
| 17 | password. In both cases
|
|---|
| 18 | .B crypt()
|
|---|
| 19 | calls
|
|---|
| 20 | .BR pwdauth (8)
|
|---|
| 21 | to do the real work.
|
|---|
| 22 | .PP
|
|---|
| 23 | .B Crypt()
|
|---|
| 24 | encrypts a password if called with a user typed key, and a salt
|
|---|
| 25 | whose first two characters are in the set [./0-9A-Za-z]. The result is a
|
|---|
| 26 | character string in the [./0-9A-Za-z] alphabet of which the first two
|
|---|
| 27 | characters are equal to the salt, and the rest is the result of encrypting
|
|---|
| 28 | the key and the salt.
|
|---|
| 29 | .PP
|
|---|
| 30 | If
|
|---|
| 31 | .B crypt()
|
|---|
| 32 | is called with a salt that has the form
|
|---|
| 33 | .BI "##" user
|
|---|
| 34 | then the key is encrypted and compared to the encrypted password of
|
|---|
| 35 | .I user
|
|---|
| 36 | in the shadow password file. If they are equal then
|
|---|
| 37 | .B crypt()
|
|---|
| 38 | returns the
|
|---|
| 39 | .BI "##" user
|
|---|
| 40 | argument, if not then some other string is returned. This trick assures
|
|---|
| 41 | that the normal way to authenticate a password still works:
|
|---|
| 42 | .PP
|
|---|
| 43 | .RS
|
|---|
| 44 | .nf
|
|---|
| 45 | if (strcmp(pw->pw_passwd, crypt(key, pw->pw_passwd))) ...
|
|---|
| 46 | .fi
|
|---|
| 47 | .RE
|
|---|
| 48 | .PP
|
|---|
| 49 | If
|
|---|
| 50 | .I key
|
|---|
| 51 | is a null string, and the shadow password is a null string or the salt is a
|
|---|
| 52 | null string then the result equals
|
|---|
| 53 | .IR salt .
|
|---|
| 54 | (This is because the caller can't tell if a password field is empty in the
|
|---|
| 55 | shadow password file.)
|
|---|
| 56 | .PP
|
|---|
| 57 | The key and salt are limited to 1024 bytes total including the null bytes.
|
|---|
| 58 | .SH FILES
|
|---|
| 59 | .TP 25
|
|---|
| 60 | /usr/lib/pwdauth
|
|---|
| 61 | The password authentication program
|
|---|
| 62 | .SH "SEE ALSO"
|
|---|
| 63 | .BR getpass (3),
|
|---|
| 64 | .BR getpwent (3),
|
|---|
| 65 | .BR passwd (5),
|
|---|
| 66 | .BR pwdauth (8).
|
|---|
| 67 | .SH NOTES
|
|---|
| 68 | The result of an encryption is returned in a static array that is
|
|---|
| 69 | overwritten by each call. The return value should not be modified.
|
|---|
| 70 | .SH AUTHOR
|
|---|
| 71 | Kees J. Bot (kjb@cs.vu.nl)
|
|---|
