A NOTE has been added to this issue. ====================================================================== http://www.dbmail.org/mantis/view.php?id=340 ====================================================================== Reported By: aaron Assigned To: aaron ====================================================================== Project: DBMail Issue ID: 340 Category: Authentication layer Reproducibility: always Severity: minor Priority: normal Status: assigned ====================================================================== Date Submitted: 05-May-06 22:51 CEST Last Modified: 07-May-06 03:19 CEST ====================================================================== Summary: MD5-HASH encryption type may be broken Description: On Thu, May 4, 2006, Aaron Stone <[EMAIL PROTECTED]> said:
> On Thu, 2006-05-04 at 00:18 -0700, kbaker wrote: > >> Java md5-digest result: >> X03MO1qnZdYdgyfeuILPmQ== >> >> dbmail-util -p md5-hash-raw result: >> X03MO1qnZdYdgyfeuILPmQ== >> >> So I would like to use the md5-hash-raw encoding.... problem is that >> when I do I can not log into the IMAP account. The database shows teh >> md5-hash-raw encoding as MD5 > > Ok, yeah, I do see that something isn't working right. I'll have some > time this weekend to soak my head in the MD5 stuff again. Just an FYI -- this isn't fixed in 2.1.6 because the code looks almost the same as code going back to 2.0, which means its possible that this MD5 mode never worked right. I'm going to write a test suite module before making any changes so that we don't get any regressions in the other password encryption types. Aaron ====================================================================== ---------------------------------------------------------------------- aaron - 07-May-06 03:19 ---------------------------------------------------------------------- Ok, so I knew that the == off the end of those was familiar! It's the MD5 encoded in base64. Incidentally, the the -raw variants mean that you're supplying the password in pre-encoded in the format that DBMail is expecting. The is useful for grabbing passwords from other sources (as you're doing). As for md5-hash / md5-hash-raw showing only "md5" in the database, its because md5 and md5-hash are aliases. I'm working on a patch to add md5base64 support. Issue History Date Modified Username Field Change ====================================================================== 05-May-06 22:51 aaron New Issue 05-May-06 22:51 aaron Status new => assigned 05-May-06 22:51 aaron Assigned To => aaron 07-May-06 03:19 aaron Note Added: 0001156 ======================================================================
