Mailing-List: contact dev-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@couchdb.apache.org
Received-SPF: pass (athena.apache.org: domain of b.candler@pobox.com
 designates 208.72.237.25 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=pobox.com; h=date:from:to
	:subject:message-id:references:mime-version:content-type
	:in-reply-to; q=dns; s=sasl; b=SS3uvLTClspgDiD+lvz7WkZJ+C3bRLgE4
	lUmBXh7Tya8R3QbH+iIgxIbOHrjvA/Ba/twbgvHWlg95q6Uvd5wm1pt41f0cHQZt
	FEoTlyli14RncjdXco1ybWURexKgUpoBL0pfl/JRLXBG2N+dkyzCJwiFevA+FSRr
	8E1XqlL3Nc=
Date: Sun, 7 Feb 2010 18:45:17 +0000
From: Brian Candler <B.Candler@pobox.com>
To: dev@couchdb.apache.org
Subject: Re: JavaScript bcrypt (was Re: authentication cleanup)
Message-ID: <20100207184517.GA5397@uk.tiscali.com>
References: <e282921e1001252102p7da8600fye472d04c1523fe49@mail.gmail.com>
 <38E834CA-4265-4441-9A31-C9D8BC4C0937@apache.org>
 <20100127152710.GA6385@uk.tiscali.com>
 <0B15EAAB-40E3-41B6-831E-664258A06399@apache.org>
 <e282921e1001270826u5e4ad8cds23c50f963f0aa08d@mail.gmail.com>
 <b7cd8ed11001271120x2029a5c5if155725f669bdc2a@mail.gmail.com>
 <705e509c1002061711n3f855d96s1d330e4c8d264a31@mail.gmail.com>
 <e282921e1002061731h73efbaeer8399397d6aa9fdc5@mail.gmail.com>
 <20100207092153.GA4849@uk.tiscali.com>
 <e282921e1002071023o7a8d965co494aa23ff3234c38@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <e282921e1002071023o7a8d965co494aa23ff3234c38@mail.gmail.com>
User-Agent: Mutt/1.5.20 (2009-06-14)

On Sun, Feb 07, 2010 at 10:23:17AM -0800, Chris Anderson wrote:
> > password: "plain"
> > password: "{CRYPT}$1$foo$bar"
> > password: "{SHA1}..."
> > password: "{SSHA1}...with salt..."
> > ... etc
> >
> 
> That doesn't sound bad at all.
...
> If we can't find an Erlang library, is there a spec we should look at
> while implementing?

Yep, it's here:
http://www.openldap.org/doc/admin24/security.html

Scroll down to section 14.4. Well actually it's not a full spec as it
doesn't show how the salt and value are separated in SSHA1, but you can get
that from the source.

Note that the {CRYPT} format is a unix crypt, which is itself an extensible
format; $2$...  is what openbsd are using for bcrypt.

So actually you could just use that format. The OpenLDAP format would allow
you to support existing salted SHA1 passwords in the same field.

B.