0

A tutorial is asking me to encrypt passwords using SHA512 in the following manner:

INSERT INTO `vir_users`
(`id`, `domain_id`, `password` , `email`)
VALUES
('1', '1', ENCRYPT('pw1', CONCAT('$6$', SUBSTRING(SHA(RAND()), -16))), 'email1@example.com'),
('2', '1', ENCRYPT('pw2', CONCAT('$6$', SUBSTRING(SHA(RAND()), -16))), 'email2@example.com');

How would I replace this with a MySQL 5.7 non-deprecated AES_ENCRYPT instead of the old ENCRYPT way of doing things?

MySQL's documentation is severely lacking in this case at it does NOT provide any clear examples.

I found a way of doing it outside the DBMS, however I would like to keep it all contained and not dependant on external code and/or tools; that's why would like to know.

When I run this query now, I get this error message:

'ENCRYPT' is deprecated and will be removed in a future release. Please use AES_ENCRYPT instead

update: The reason it's using this is because I need to store the password in such a way that Dovecot's default_pass_scheme (which is set to SHA512-CRYPT) can validate my passwords.

The $6$ part of the passwords seems to be important.. I don't know why, but all passwords that are generated the old way start with that. Please check the tutorial on why this is.

  • For some reason, the $6$ is important.. generated passwords must begin with those 3 characters.. if only I could figure out how to generate those with AES_ENCRYPT... – Henry van Megen Jan 29 '18 at 15:45
1

----- 2014-09-25 5.7.5 Milestone 15 -- Security Notes -- -----

Incompatible Change: MySQL 5.6 deprecated passwords that used the older pre-4.1 password hashing format. Support for these passwords is now removed, which involves the following changes. Applications that use any feature no longer supported must be modified.

Playing around with passwords seems like a dumb thing to have in a tutorial. Please skip that section and move on.

  • Sorry I wasn't clear before, but the reason I need this is because Dovecot only understand SHA512-CRYPT as it's default_pass_scheme setting. I know what hashing is, and I know what encryption is, but I couldn't tell you how I could encrypt something with AES_ENCRYPT into SHA512-CRYPT (or SHA512 for that matter) even if my life depended on it. I can't simply skip that section and move on, otherwise I'll have no email accounts and/or email accounts without passwords. – Henry van Megen Jan 29 '18 at 15:31
  • Search for "salt" in discussions about encryption. Possibly the $6$ is a salt. The exact code for the encryption function may involve a salt, or other techniques for obfuscation, etc. – Rick James Jan 29 '18 at 16:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.