0

I use the ENCRYPT function to generate password for my email users.

SELECT ENCRYPT('password', CONCAT('$6$', SUBSTRING(SHA(RAND()), -16)))

This function will generate a long encrypted string which looks something like this:

$6$103b1e8ad6b6db7d$CyTHP3ooA8N8uWtKmQOZFjRkTss60o3ckb6CPYG01uJqiLjGMFU0y9jtCA13MFtJ3LiPrKv5JVcfRaYg8B7YL0

Now my question is how I can verify the password? What I want to do is I store the encrypted password in the database. And I want my user to be able to modify their password as long as they provide the correct old password. So when the users provide their old passwords, I need to verify whether the old password they provided is correct or not.

2

When you store a password you have to store encrypt(password,salt) and salt for this user. To check if input from user is the right password you comapre encrypt(input,salt) with the stored encrypted string. Chanck the section about 8.6.2 What Is Salt? in Practical UNIX & Internet Security, by Simson Garfinkel & Gene Spafford from O'Reilly.

  • Aha!! select ENCRYPT('password', CONCAT('$6$', 'abcdefg')), I got $6$abcdefg$3X6B9zrxtsDSfe156ekDjYJE5pBAceZ/kH.QSD8ox8dEyWApg7m77P.AVlozLKGG9WTEbwcb/gjbMape6/Ios1. I think it's solved. The salt is indeed stored in the encrypted password. – Qian Chen Aug 3 '15 at 20:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.