[Dovecot] HMAC-MD5 / HMAC-MD5-context
$ dovecotpw -p testpass {HMAC-MD5}fe8522268d91e485ccac8f36800e4fa6b10363e2a371cfa61731109b450906cd
I wonder if the prefix 'HMAC-MD5' is the correct notation here. According to RFC2104 an HMAC is calculated as follows:
H(K XOR opad, H(K XOR ipad, text))
where H is the cryptographic hash function (MD5 in this case). Therefore the result has to be a 128 bit string, which is obviously not the case in the above shown example. In addition, the input value 'text' is missing if you only have a password K.
Maybe it would be better to use {HMAC-MD5-CONTEXT} or {HMAC-MD5-CTX} ?
Chris
On 234, 08 22, 2006 at 11:30:07AM +0200, Chris Laif wrote:
$ dovecotpw -p testpass {HMAC-MD5}fe8522268d91e485ccac8f36800e4fa6b10363e2a371cfa61731109b450906cd
I wonder if the prefix 'HMAC-MD5' is the correct notation here. According to RFC2104 an HMAC is calculated as follows:
H(K XOR opad, H(K XOR ipad, text))
where H is the cryptographic hash function (MD5 in this case). Therefore the result has to be a 128 bit string, which is obviously not the case in the above shown example. In addition, the input value 'text' is missing if you only have a password K.
Maybe it would be better to use {HMAC-MD5-CONTEXT} or {HMAC-MD5-CTX} ?
This change will break existing dovecot installations without any real gain.
-- Andrey Panin | Linux and UNIX system administrator pazke@donpac.ru | PGP key: wwwkeys.pgp.net
Andrey Panin wrote:
On 234, 08 22, 2006 at 11:30:07AM +0200, Chris Laif wrote:
$ dovecotpw -p testpass {HMAC-MD5}fe8522268d91e485ccac8f36800e4fa6b10363e2a371cfa61731109b450906cd
I wonder if the prefix 'HMAC-MD5' is the correct notation here. According to RFC2104 an HMAC is calculated as follows:
H(K XOR opad, H(K XOR ipad, text))
where H is the cryptographic hash function (MD5 in this case). Therefore the result has to be a 128 bit string, which is obviously not the case in the above shown example. In addition, the input value 'text' is missing if you only have a password K.
Maybe it would be better to use {HMAC-MD5-CONTEXT} or {HMAC-MD5-CTX} ?
This change will break existing dovecot installations without any real gain.
Correctness is IMO much more important than backward compatibility with buggy/broken behaviour.
-- VH
On Tue, Aug 22, 2006 at 03:16:15PM +0200, V?clav Haisman wrote:
Andrey Panin wrote:
On 234, 08 22, 2006 at 11:30:07AM +0200, Chris Laif wrote:
Maybe it would be better to use {HMAC-MD5-CONTEXT} or {HMAC-MD5-CTX} ?
This change will break existing dovecot installations without any real gain.
Correctness is IMO much more important than backward compatibility with buggy/broken behaviour.
The string is correct. Dovecot's format in this regard is derived from (but not identical with) the LDAP format, RFC 3112, and the string enclosed in {} denotes the name of the password scheme to use with this data, and NOT the type of the data that follows.
JG
-- Josh "Koshua" Goodall "as modern as tomorrow afternoon" joshua@roughtrade.net - FW109
participants (4)
-
Andrey Panin
-
Chris Laif
-
Joshua Goodall
-
Václav Haisman