Welcome, Guest. Register Now!
   
Mark Forums Read Mark Forums Read Mark Forums Read


Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 01-09-2008, 02:11 PM
Junior Member
 
Join Date: Dec 2007
Location: Brazil
Posts: 1
Default Salted passwords?

How can I authenticate salted passwords with Zend_Auth_Adapter_DbTable ?
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #2 (permalink)  
Old 01-13-2008, 02:31 AM
SpotSec's Avatar
Senior Member
 
Join Date: Feb 2007
Location: United States
Posts: 121
Default

Generally you would salt the pw before handing it over to Zend_Auth to validate.
__________________
Zym Framework - A Zend Framework extension library w/ demo app

SpotSec Blog:
http://spotsec.com/blog
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #3 (permalink)  
Old 02-05-2008, 08:19 PM
Junior Member
 
Join Date: Feb 2008
Posts: 1
Default

I don't know if you still need it but I use this method:
PHP Code:
$adapter->setCredentialTreatment('your salting method'
You can set it also when you create the instance of Zend_Auth_Adapter_DbTable, its the 5th parameter:

PHP Code:
new Zend_Auth_Adapter_DbTable($db
    
'your db table name'
    
'your user column name'
    
'your credential column name'
    
'your salting method'
To salt the password you could use
PHP Code:
MD5(CONCAT(?,'yoursalt')) 
as argument in the method
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #4 (permalink)  
Old 02-12-2008, 04:00 PM
Senior Member
 
Join Date: Jan 2008
Location: chicago
Posts: 101
Default

What is 'salting a password'?

Does that mean saving the password as an encrypted string?
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #5 (permalink)  
Old 02-13-2008, 08:52 AM
Junior Member
 
Join Date: Feb 2008
Posts: 3
Default

if you just do md5($passwort) someone who get an dump of your Database is maybe able to search at md5.rednoize.com - reverse engineer md5 hashes for it. For Example, there is an user with the passwort md5 098f6bcd4621d373cade4e832627b4f6 now search at md5.renoize.com for it: Search 098f6bcd4621d373cade4e832627b4f6

No the "owner" of your dump is able to login with the original passwort.

if you salt your passwort, for example with the login name (bad idea), the md5 for Salz`test looks like this: 99a5e84373b3bac5aeeaca03669556ed (md5.rednoize can lookup, cause i use it to generate the checksum)
This makes more difficult to get the passwort.

Last edited by Salz` : 02-13-2008 at 08:56 AM.
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT. The time now is 09:41 AM.