Page 1 of 1

Cram MD5

Posted: Wed Aug 16, 2006 1:28 pm
by Todd_Z
Anyone having trouble with the hash functions?

It says it's installed as of 5.1.2, but... its not on any of my systems [debian and freebsd based].

Any idea how to install functionality without the PECL module?

All i need is a function that will encrypt a string using the cram-md5 hash [ to be able to validate courier-imap with my custom login database ]

Posted: Wed Aug 16, 2006 1:49 pm
by feyd
There's a PEAR module for HMAC.

Alternatively, the HMAC algorithm doesn't look all that complicated to implement... although Wikipedia's math image does look crazy, it's explained below it.

Posted: Wed Aug 16, 2006 2:01 pm
by Todd_Z
Is there a command line utility that could spit out the encrypted argument?

I haven't been able to find one.

Posted: Wed Aug 16, 2006 2:01 pm
by Chris Corbyn
This was taken from the PEAR SMTP auth library and adapted for my needs.

Code: Select all

function _authGenerateCRAM_MD5_Response($password, $challenge)
	{
		if (strlen($password) > 64)
			$password = pack('H32', md5($password));

		if (strlen($password) < 64)
			$password = str_pad($password, 64, chr(0));

		$k_ipad = substr($password, 0, 64) ^ str_repeat(chr(0x36), 64);
		$k_opad = substr($password, 0, 64) ^ str_repeat(chr(0x5C), 64);

		$inner  = pack('H32', md5($k_ipad.$challenge));
		$digest = md5($k_opad.$inner);

		return $digest;
	}

Posted: Wed Aug 16, 2006 2:06 pm
by Todd_Z
wow. perfect. thanks :D