2

A tutorial is asking me to encrypt passwords using SHA512 in the following manner:

INSERT INTO `vir_users`
(`id`, `domain_id`, `password` , `email`)
VALUES
('1', '1', ENCRYPT('pw1', CONCAT('$6$', SUBSTRING(SHA(RAND()), -16))), '[email protected]'),
('2', '1', ENCRYPT('pw2', CONCAT('$6$', SUBSTRING(SHA(RAND()), -16))), '[email protected]');

How would I replace this with a MySQL 5.7 non-deprecated AES_ENCRYPT instead of the old ENCRYPT way of doing things?

MySQL's documentation is severely lacking in this case at it does NOT provide any clear examples.

I found a way of doing it outside the DBMS, however, I would like to keep it all contained and not dependent on external code and/or tools; that's why would like to know.

When I run this query now, I get this error message:

'ENCRYPT' is deprecated and will be removed in a future release. Please use AES_ENCRYPT instead

update: The reason it's using this is that I need to store the password in such a way that Dovecot's default_pass_scheme (which is set to SHA512-CRYPT) can validate my passwords.

The $6$ part of the passwords seems to be important.. I don't know why, but all passwords that are generated the old way start with that. Please check the tutorial on why this is.

Improve this question
3
  • For some reason, the $6$ is important.. generated passwords must begin with those 3 characters.. if only I could figure out how to generate those with AES_ENCRYPT...
    – Henry van Megen
    Jan 29, 2018 at 15:45
  • Have you managed to figure this out? I am stuck for many hours on exactly THIS
    – Hugo Cox
    Jan 14, 2021 at 16:19
  • 1
    I've been able to generate passwords with this: TO_BASE64(UNHEX(SHA2('password_goes_here', 512))) Don't forget to upvote this question if you were stuck on it too...
    – Henry van Megen
    Jan 21, 2021 at 13:59

1 Answer 1

Reset to default
0

----- 2014-09-25 5.7.5 Milestone 15 -- Security Notes -- -----

Incompatible Change: MySQL 5.6 deprecated passwords that used the older pre-4.1 password hashing format. Support for these passwords is now removed, which involves the following changes. Applications that use any feature no longer supported must be modified.

Playing around with passwords seems like a dumb thing to have in a tutorial. Please skip that section and move on.

Improve this answer
3
  • Sorry I wasn't clear before, but the reason I need this is because Dovecot only understand SHA512-CRYPT as it's default_pass_scheme setting. I know what hashing is, and I know what encryption is, but I couldn't tell you how I could encrypt something with AES_ENCRYPT into SHA512-CRYPT (or SHA512 for that matter) even if my life depended on it. I can't simply skip that section and move on, otherwise I'll have no email accounts and/or email accounts without passwords.
    – Henry van Megen
    Jan 29, 2018 at 15:31
  • Search for "salt" in discussions about encryption. Possibly the $6$ is a salt. The exact code for the encryption function may involve a salt, or other techniques for obfuscation, etc.
    – Rick James
    Jan 29, 2018 at 16:02
  • $6 is the password scheme followed by the salt corresponding to SHA512-CRYPT.
    – danblack
    Sep 13, 2021 at 0:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.